Description
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages 





Impact:


An attacker may trick authenticated BIG-IP users
into accessing malicious links and reflect a spoofed error message in
the victim's BIG-IP Configuration utility web browser session. This is a
control plane issue; there is no data plane exposure.





Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published: 2026-09-02
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

To mitigate this vulnerability, you may take the following actions: When you have finished using the BIG-IP Configuration utility, you should log off and close all instances of your web browser. Do not use the same web browser that you use to manage the BIG-IP Configuration utility for any other purposes, such as browsing the internet. If you must perform both actions on the same client machine, F5 recommends that you do so in separate browsers

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title BIG-IP Configuration utility vulnerability
Weaknesses CWE-451
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: f5

Published:

Updated: 2026-09-02T17:55:45.119Z

Reserved: 2026-07-24T22:40:21.245Z

Link: CVE-2026-63020

cve-icon Vulnrichment

Updated: 2026-09-02T17:55:40.635Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T16:17:18.400

Modified: 2026-09-02T19:23:13.660

Link: CVE-2026-63020

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information