Skip to content
Advisories.
f5CVE-2026-63020

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing...

Low2.3CVE-2026-63020 · Published Sep 2, 2026 · updated Sep 15, 2026

Source advisory

Affected versions

PackageAffectedFixed in
BIG-IP
Vendor
>= 21.1.0, < 21.1.0.121.1.0.1
>= 21.0.0, < 21.0.0.321.0.0.3
>= 17.5.0, < 17.5.1.817.5.1.8
>= 17.1.0, < 17.1.3.417.1.3.4
Details and references

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
no source yet
Weakness
CWE-451

More f5 advisories

All
DateAdvisory
Sep 2Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous...
CVE-2026-18329High8.8fixed in NGINX JavaScript 1.0.1
Sep 2Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.
CVE-2026-66362High8.6fixed in NGINX Gateway Fabric 2.6.8
Sep 2BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).
CVE-2026-66842High8.7fixed in BIG-IP 21.1.0.1, BIG-IP 21.0.0.3, BIG-IP 17.5.1.8
Sep 2When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller.
CVE-2026-77180High8.7fixed in NGINX Ingress Controller 5.6.0, NGINX Ingress Controller 2026-lts-r5
Sep 2A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText.
CVE-2026-78222High8.7fixed in NGINX JavaScript 1.0.1
Sep 2Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method.
CVE-2026-78689Critical9.2fixed in NGINX JavaScript 1.0.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.