CVE-2026-32643: Privilege Escalation in F5 BIG-IP

The impact of CVE-2026-32643 is significant due to the potential for complete system compromise. An attacker who can leverage this vulnerability gains the ability to run arbitrary commands with elevated privileges, effectively bypassing standard security controls. This could lead to data exfiltration, system modification, denial of service, or even complete takeover of the affected BIG-IP or BIG-IQ instance. The Certificate Manager role, while privileged, is often granted to multiple administrators, expanding the potential attack surface. The ability to modify configuration objects is a critical pathway for attackers to establish persistent access or pivot to other systems within the network.

1. Gereserveerd2026-04-30
2. Gepubliceerd2026-05-13

The primary mitigation for CVE-2026-32643 is to upgrade to F5 BIG-IP version 21.0.0.2 or later, which contains the fix. If immediate upgrade is not feasible, consider implementing stricter access controls for the Certificate Manager role, limiting its scope and duration. Review existing configurations for any unusual or unauthorized modifications. Implement network segmentation to limit the potential blast radius of a successful exploit. While a WAF or proxy cannot directly prevent this vulnerability, it can help detect and block suspicious command execution attempts. Monitor system logs for unusual activity related to configuration object modifications.