BIG-IP
CVE-2026-63020: BIG-IP Configuration utility vulnerability
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| BIG-IP 21.1 | 21.1.0.1 or later |
| BIG-IP 21.0 | 21.0.0.3 or later |
| BIG-IP 17.5 | 17.5.1.8 or later |
| BIG-IP 17.1 | 17.1.3.4 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages
Impact:
An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Workarounds
To mitigate this vulnerability, you may take the following actions:
When you have finished using the BIG-IP Configuration utility, you should log off and close all instances of your web browser. Do not use the same web browser that you use to manage the BIG-IP Configuration utility for any other purposes, such as browsing the internet. If you must perform both actions on the same client machine, F5 recommends that you do so in separate browsers
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.