Vulnerability Details CVE-2026-63020
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages
Impact:
An attacker may trick authenticated BIG-IP users
into accessing malicious links and reflect a spoofed error message in
the victim's BIG-IP Configuration utility web browser session. This is a
control plane issue; there is no data plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.4%
CVSS Severity
CVSS v3 Score 3.1
Products affected by CVE-2026-63020
-
cpe:2.3:a:f5:big-ip_access_policy_manager:*
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0.1
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0.2
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0.3
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.1
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.1.3
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.1.4
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.2
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.2.1
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.2.2
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.3
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.5.0
-
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.5.1
-
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*
-
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.5.0
-
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.5.1
-
cpe:2.3:a:f5:big-ip_analytics:*
-
cpe:2.3:a:f5:big-ip_analytics:17.5.0
-
cpe:2.3:a:f5:big-ip_analytics:17.5.1
-
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*
-
cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.5.0
-
cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.5.1
-
cpe:2.3:a:f5:big-ip_application_security_manager:*
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0.1
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0.2
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0.3
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.1
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.1.3
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.1.4
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.2
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.2.1
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.2.2
-
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.3
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0.1
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0.2
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.1
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.1.3
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.1.4
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.2
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.2.1
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.2.2
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.3
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.5.0
-
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.5.1
-
cpe:2.3:a:f5:big-ip_automation_toolchain:*
-
cpe:2.3:a:f5:big-ip_automation_toolchain:17.5.0
-
cpe:2.3:a:f5:big-ip_automation_toolchain:17.5.1
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0.1
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0.2
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.1
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.1.3
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.1.4
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.2
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.2.1
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.2.2
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.3
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.5.0
-
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.5.1
-
cpe:2.3:a:f5:big-ip_container_ingress_services:*
-
cpe:2.3:a:f5:big-ip_container_ingress_services:17.5.0
-
cpe:2.3:a:f5:big-ip_container_ingress_services:17.5.1
-
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*
-
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.5.0
-
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.5.1
-
cpe:2.3:a:f5:big-ip_domain_name_system:*
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0.1
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0.2
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0.3
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.1
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.1.3
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.1.4
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.2
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.2.1
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.2.2
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.3
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.5.0
-
cpe:2.3:a:f5:big-ip_domain_name_system:17.5.1
-
cpe:2.3:a:f5:big-ip_edge_gateway:*
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.0
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.0.1
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.0.2
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.1.3
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.1.4
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.2
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.2.1
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.2.2
-
cpe:2.3:a:f5:big-ip_edge_gateway:17.1.3
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:*
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0.1
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0.2
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.1
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.1.3
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.1.4
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.2
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.2.1
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.2.2
-
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.3
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:*
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0.1
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0.2
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.1
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.1.3
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.1.4
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.2
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.2.1
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.2.2
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.3
-
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.5.0
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.0
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.0.1
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.1
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.1.3
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.1.4
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.2
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.2.1
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.2.2
-
cpe:2.3:a:f5:big-ip_link_controller:17.1.3
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:*
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0.1
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0.2
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0.3
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.1
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.1.3
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.1.4
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.2
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.2.1
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.2.2
-
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.3
-
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.5.0
-
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.5.1
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0.1
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0.2
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.1
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.1.3
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.1.4
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.2
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.2.1
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.2.2
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.3
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0
-
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.1
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0.1
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0.2
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.1
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.1.3
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.1.4
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.2
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.2.1
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.2.2
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.3
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.5.0
-
cpe:2.3:a:f5:big-ip_webaccelerator:17.5.1
-
cpe:2.3:a:f5:big-ip_websafe:*
-
cpe:2.3:a:f5:big-ip_websafe:17.1.0
-
cpe:2.3:a:f5:big-ip_websafe:17.1.0.1
-
cpe:2.3:a:f5:big-ip_websafe:17.1.0.2
-
cpe:2.3:a:f5:big-ip_websafe:17.1.1
-
cpe:2.3:a:f5:big-ip_websafe:17.1.1.3
-
cpe:2.3:a:f5:big-ip_websafe:17.1.1.4
-
cpe:2.3:a:f5:big-ip_websafe:17.1.2
-
cpe:2.3:a:f5:big-ip_websafe:17.1.2.1
-
cpe:2.3:a:f5:big-ip_websafe:17.1.2.2
-
cpe:2.3:a:f5:big-ip_websafe:17.1.3
-
cpe:2.3:a:f5:big-ip_websafe:17.5.0
-
cpe:2.3:a:f5:big-ip_websafe:17.5.1