CVE-2026-63020: BIG-IP Configuration utility vulnerability

Q: Who is exposed to this issue?

The issue affects authenticated BIG-IP Configuration Utility users in the control plane. There is no data plane exposure.

Q: What must an attacker do to exploit it?

An attacker must trick an authenticated BIG-IP user into accessing malicious links. Exploitation can result in spoofed error messages being reflected in that user's Configuration Utility browser session.

Q: Are end-of-support BIG-IP software versions covered by the evaluation?

No. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

Published Sep 2, 2026

Updated

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages

Impact:

An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

64 affected components

F5 BIG-IP Configuration Utility

F5 BIG-IP Access Policy Manager>=17.1.0<=17.1.3

F5 BIG-IP Access Policy Manager>=17.5.0<=17.5.1

F5 BIG-IP Advanced Firewall Manager>=17.1.0<=17.1.3

F5 BIG-IP Advanced Firewall Manager>=17.5.0<=17.5.1

F5 Big-ip Advanced Web Application Firewall>=17.1.0<=17.1.3

F5 Big-ip Advanced Web Application Firewall>=17.5.0<=17.5.1

F5 BIG-IP Analytics>=17.1.0<=17.1.3

F5 BIG-IP Analytics>=17.5.0<=17.5.1

F5 Big-ip Application Acceleration Manager>=17.1.0<=17.1.3

F5 Big-ip Application Acceleration Manager>=17.5.0<=17.5.1

F5 BIG-IP Application Security Manager>=17.1.0<=17.1.3

F5 BIG-IP Application Security Manager>=17.5.0<=17.5.1

F5 Big-ip Application Visibility And Reporting>=17.1.0<=17.1.3

F5 Big-ip Application Visibility And Reporting>=17.5.0<=17.5.1

F5 Big-ip Automation Toolchain>=17.1.0<=17.1.3

F5 Big-ip Automation Toolchain>=17.5.0<=17.5.1

F5 Big-ip Carrier-grade Nat>=17.1.0<=17.1.3

F5 Big-ip Carrier-grade Nat>=17.5.0<=17.5.1

F5 BIG-IP Container Ingress Services>=17.1.0<=17.1.3

F5 BIG-IP Container Ingress Services>=17.5.0<=17.5.1

F5 Big-ip Ddos Hybrid Defender>=17.1.0<=17.1.3

F5 Big-ip Ddos Hybrid Defender>=17.5.0<=17.5.1

F5 Big-ip Domain Name System>=17.1.0<=17.1.3

F5 Big-ip Domain Name System>=17.5.0<=17.5.1

F5 BIG-IP Edge Gateway>=17.1.0<=17.1.3

F5 BIG-IP Edge Gateway>=17.5.0<=17.5.1

F5 Big-ip Fraud Protection Service>=17.1.0<=17.1.3

F5 Big-ip Fraud Protection Service>=17.5.0<=17.5.1

F5 Big-ip Global Traffic Manager>=17.1.0<=17.1.3

F5 Big-ip Global Traffic Manager>=17.5.0<=17.5.1

F5 Big-ip Link Controller>=17.1.0<=17.1.3

F5 Big-ip Link Controller>=17.5.0<=17.5.1

F5 Big-ip Local Traffic Manager>=17.1.0<=17.1.3

F5 Big-ip Local Traffic Manager>=17.5.0<=17.5.1

F5 Big-ip Policy Enforcement Manager>=17.1.0<=17.1.3

F5 Big-ip Policy Enforcement Manager>=17.5.0<=17.5.1

F5 BIG-IP SSL Orchestrator>=17.1.0<=17.1.3

F5 BIG-IP SSL Orchestrator>=17.5.0<=17.5.1

F5 Big-ip Webaccelerator>=17.1.0<=17.1.3

F5 Big-ip Webaccelerator>=17.5.0<=17.5.1

F5 Big-ip Websafe>=17.1.0<=17.1.3

F5 Big-ip Websafe>=17.5.0<=17.5.1

F5 BIG-IP Access Policy Manager>=21.0.0<=21.1.0

F5 BIG-IP Advanced Firewall Manager>=21.0.0<=21.1.0

F5 Big-ip Advanced Web Application Firewall>=21.0.0<=21.1.0

F5 BIG-IP Analytics>=21.0.0<=21.1.0

F5 Big-ip Application Acceleration Manager>=21.0.0<=21.1.0

F5 BIG-IP Application Security Manager>=21.0.0<=21.1.0

F5 Big-ip Application Visibility And Reporting>=21.0.0<=21.1.0

F5 Big-ip Automation Toolchain>=21.0.0<=21.1.0

F5 Big-ip Carrier-grade Nat>=21.0.0<=21.1.0

F5 BIG-IP Container Ingress Services>=21.0.0<=21.1.0

F5 Big-ip Ddos Hybrid Defender>=21.0.0<=21.1.0

F5 Big-ip Domain Name System>=21.0.0<=21.1.0

F5 BIG-IP Edge Gateway>=21.0.0<=21.1.0

F5 Big-ip Fraud Protection Service>=21.0.0<=21.1.0

F5 Big-ip Global Traffic Manager>=21.0.0<=21.1.0

F5 Big-ip Link Controller>=21.0.0<=21.1.0

F5 Big-ip Local Traffic Manager>=21.0.0<=21.1.0

F5 Big-ip Policy Enforcement Manager>=21.0.0<=21.1.0

F5 BIG-IP SSL Orchestrator>=21.0.0<=21.1.0

F5 Big-ip Webaccelerator>=21.0.0<=21.1.0

F5 Big-ip Websafe>=21.0.0<=21.1.0

Event History

Sep 2, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

The issue affects authenticated BIG-IP Configuration Utility users in the control plane. There is no data plane exposure.

What must an attacker do to exploit it?

An attacker must trick an authenticated BIG-IP user into accessing malicious links. Exploitation can result in spoofed error messages being reflected in that user's Configuration Utility browser session.

Are end-of-support BIG-IP software versions covered by the evaluation?