CVE-2026-63020

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• f5 big-ip access policy manager (>= 17.1.0 <= 17.1.3) • f5 big-ip access policy manager (>= 17.5.0 <= 17.5.1) • f5 big-ip advanced firewall manager (>= 17.1.0 <= 17.1.3) • f5 big-ip advanced firewall manager (>= 17.5.0 <= 17.5.1) • f5 big-ip advanced web application firewall (>= 17.1.0 <= 17.1.3) • f5 big-ip advanced web application firewall (>= 17.5.0 <= 17.5.1) • f5 big-ip analytics (>= 17.1.0 <= 17.1.3) • f5 big-ip analytics (>= 17.5.0 <= 17.5.1) • f5 big-ip application acceleration manager (>= 17.1.0 <= 17.1.3) • f5 big-ip application acceleration manager (>= 17.5.0 <= 17.5.1) • f5 big-ip application security manager (>= 17.1.0 <= 17.1.3) • f5 big-ip application security manager (>= 17.5.0 <= 17.5.1) • f5 big-ip application visibility and reporting (>= 17.1.0 <= 17.1.3) • f5 big-ip application visibility and reporting (>= 17.5.0 <= 17.5.1) • f5 big-ip automation toolchain (>= 17.1.0 <= 17.1.3) • f5 big-ip automation toolchain (>= 17.5.0 <= 17.5.1) • f5 big-ip carrier-grade nat (>= 17.1.0 <= 17.1.3) • f5 big-ip carrier-grade nat (>= 17.5.0 <= 17.5.1) • f5 big-ip container ingress services (>= 17.1.0 <= 17.1.3) • f5 big-ip container ingress services (>= 17.5.0 <= 17.5.1) • f5 big-ip ddos hybrid defender (>= 17.1.0 <= 17.1.3) • f5 big-ip ddos hybrid defender (>= 17.5.0 <= 17.5.1) • f5 big-ip domain name system (>= 17.1.0 <= 17.1.3) • f5 big-ip domain name system (>= 17.5.0 <= 17.5.1) • f5 big-ip edge gateway (>= 17.1.0 <= 17.1.3) • f5 big-ip edge gateway (>= 17.5.0 <= 17.5.1) • f5 big-ip fraud protection service (>= 17.1.0 <= 17.1.3) • f5 big-ip fraud protection service (>= 17.5.0 <= 17.5.1) • f5 big-ip global traffic manager (>= 17.1.0 <= 17.1.3) • f5 big-ip global traffic manager (>= 17.5.0 <= 17.5.1) • f5 big-ip link controller (>= 17.1.0 <= 17.1.3) • f5 big-ip link controller (>= 17.5.0 <= 17.5.1) • f5 big-ip local traffic manager (>= 17.1.0 <= 17.1.3) • f5 big-ip local traffic manager (>= 17.5.0 <= 17.5.1) • f5 big-ip policy enforcement manager (>= 17.1.0 <= 17.1.3) • f5 big-ip policy enforcement manager (>= 17.5.0 <= 17.5.1) • f5 big-ip ssl orchestrator (>= 17.1.0 <= 17.1.3) • f5 big-ip ssl orchestrator (>= 17.5.0 <= 17.5.1) • f5 big-ip webaccelerator (>= 17.1.0 <= 17.1.3) • f5 big-ip webaccelerator (>= 17.5.0 <= 17.5.1) • f5 big-ip websafe (>= 17.1.0 <= 17.1.3) • f5 big-ip websafe (>= 17.5.0 <= 17.5.1) • f5 big-ip access policy manager (>= 21.0.0 <= 21.1.0) • f5 big-ip advanced firewall manager (>= 21.0.0 <= 21.1.0) • f5 big-ip advanced web application firewall (>= 21.0.0 <= 21.1.0) • f5 big-ip analytics (>= 21.0.0 <= 21.1.0) • f5 big-ip application acceleration manager (>= 21.0.0 <= 21.1.0) • f5 big-ip application security manager (>= 21.0.0 <= 21.1.0) • f5 big-ip application visibility and reporting (>= 21.0.0 <= 21.1.0) • f5 big-ip automation toolchain (>= 21.0.0 <= 21.1.0) • f5 big-ip carrier-grade nat (>= 21.0.0 <= 21.1.0) • f5 big-ip container ingress services (>= 21.0.0 <= 21.1.0) • f5 big-ip ddos hybrid defender (>= 21.0.0 <= 21.1.0) • f5 big-ip domain name system (>= 21.0.0 <= 21.1.0) • f5 big-ip edge gateway (>= 21.0.0 <= 21.1.0) • f5 big-ip fraud protection service (>= 21.0.0 <= 21.1.0) • f5 big-ip global traffic manager (>= 21.0.0 <= 21.1.0) • f5 big-ip link controller (>= 21.0.0 <= 21.1.0) • f5 big-ip local traffic manager (>= 21.0.0 <= 21.1.0) • f5 big-ip policy enforcement manager (>= 21.0.0 <= 21.1.0) … and 3 more