CVE-2026-63020
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure.
Risk Assessment
Risk of social engineering and manipulation of authenticated users, potentially leading to unauthorized actions in BIG-IP configuration.
Recommendation
Apply security patches provided by the vendor for BIG-IP if available, and instruct users to be cautious when clicking links.
Other vulnerabilities in BIG-IP
See all- CVE-2017-6168High
BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.
- CVE-2026-94127Critical
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). This is a data plane issue; there is no control plane exposure. The BIG-IP system in Appliance mode is also vulnerable.
- CVE-2026-66842High
A vulnerability in BIG-IP where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).
- CVE-2026-59762High
A vulnerability in the HTTP/2 profile on a BIG-IP virtual server allows an unauthenticated attacker to remotely cause increased memory utilization. This can lead to system performance degradation until the TMM process is forced or manually restarted.
- CVE-2026-40698High
A vulnerability in BIG-IP and BIG-IQ systems allows an authenticated attacker with at least the Resource Administrator role to escalate privileges by creating SNMP configuration objects via iControl REST or the TMOS shell (tmsh).
- CVE-2026-40618High
A vulnerability in BIG-IP allows TMM termination by undisclosed traffic when an SSL profile is configured on Virtual Edition without QAT or on hardware with disabled hardware acceleration.
- CVE-2026-40061High
In BIG-IP with DNS provisioned, a vulnerability exists in an undisclosed iControl REST and tmsh command. An authenticated attacker with Resource Administrator or Administrator role can execute arbitrary system commands with elevated privileges.
- CVE-2026-40060High
A vulnerability in BIG-IP Advanced WAF and ASM allows undisclosed requests to terminate the bd process when a security policy is configured on a virtual server.
- CVE-2026-39455High
In the BIG-IP Configuration utility configured to use LDAP authentication, undisclosed traffic can cause the httpd process to exhaust available file descriptors.
- CVE-2026-32673High
A vulnerability in BIG-IP scripted monitors allows an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.
Original NVD description (English source)
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.