CVE WatchSep 2, 2026

CVE-2026-63020

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact:

CVSS

3.1

Low

EPSS

—

KEV

—

Exploit Today

0-100

Published: Sep 2, 2026 · Last modified: Sep 2, 2026 · CWE-451

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Official references

my.f5.comhttps://my.f5.com/manage/s/article/K000161728

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-843564.3 MED

5.7%

——2UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)18h CVE-2026-843305.4 MED

5.7%

——2UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)1d CVE-2026-812675.4 MED

12.1%

——4A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.2d CVE-2026-792844.3 MED

13.7%

——4UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)7d CVE-2026-792835.4 MED

9.6%

——3UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)6d CVE-2026-792505.4 MED

16.2%

——5UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)6d