Executive brief
F5 BIG-IP is a widely-used load balancer and network security appliance that manages traffic and configurations for enterprise networks. This vulnerability allows an attacker to trick authenticated users into clicking malicious links that display spoofed error messages in their browser, potentially leading users to reveal credentials or perform unintended actions. However, this is limited to the management interface and does not affect data traffic or security controls.
Technical details
This is a reflected cross-site scripting (XSS) or HTML injection vulnerability in an undisclosed BIG-IP Configuration utility web page that allows an attacker to inject and display spoofed error messages. The vulnerability requires an authenticated user and is triggered via a malicious link (phishing/social engineering attack vector). An attacker cannot directly exploit this without user interaction—the victim must be tricked into visiting a crafted URL. The impact is limited to the control plane (management interface); the data plane and active traffic forwarding are not affected. F5 has published the vulnerability with low severity (CVSS 3.1).
Affected products
- F5 BIG-IP <UNKNOWN>
Timeline
- 2026-09-02: disclosed