CVE-2026-32643: Privilege Escalation in F5 BIG-IP

Successful exploitation of CVE-2026-32643 allows an attacker to gain elevated privileges within the BIG-IP system. This could lead to complete control over the device, enabling them to modify network configurations, intercept traffic, steal sensitive data (such as SSL certificates and private keys), and potentially pivot to other systems on the network. The ability to run arbitrary commands effectively grants the attacker root-level access, significantly expanding the blast radius of the attack. The Certificate Manager role, while privileged, is often granted to multiple administrators, increasing the potential attack surface. This vulnerability shares similarities with other privilege escalation flaws where misconfigured access controls allow for unauthorized command execution.

1. Reserviert2026-04-30
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-32643 is to upgrade to F5 BIG-IP version 21.0.0.2 or later, which contains the fix. If immediate upgrade is not possible, consider implementing stricter access controls to limit the number of users with the Certificate Manager role. Review existing configurations to identify any potential misconfigurations that could be exploited. Implement a Web Application Firewall (WAF) with rules to detect and block suspicious command execution attempts. Monitor BIG-IP system logs for unusual activity, particularly commands executed by users with elevated privileges. If rollback is necessary after upgrading, ensure proper backups are restored and re-evaluate access controls.