Which versions of F5 BIG-IP and BIG-IQ are affected by CVE-2026-32643?

F5 BIG-IP and BIG-IQ Certificate Manager contains a privilege escalation vulnerability allowing authenticated administrators to execute arbitrary system commands, expanding attack scope beyond the…. A patch is available.

How to fix or mitigate CVE-2026-32643?

Within 24 hours: identify all F5 BIG-IP and BIG-IQ instances in production and document current versions. Within 7 days: apply vendor patches referenced in F5 K000160972 to all affected systems; contact F5 support to confirm patch version applicability for your specific BIG-IP/BIG-IQ release line. Within 30 days: audit Certificate Manager role assignments and implement principle of least privilege access controls to restrict who holds these high-privileged credentials.

F5 BIG-IP and BIG-IQ CVE-2026-32643

Q: What is the CVSS score of CVE-2026-32643?

CVE-2026-32643 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29961 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-05-13 f5

GHSA-frv4-jxq5-mpjm

Privilege Escalation Big Ip Big Iq

8.5

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

8.7 (HIGH) 8.5 (HIGH)

Analysis Generated

May 13, 2026 - 15:50 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 8.7

DescriptionCVE.org

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Configuration manipulation in F5 BIG-IP and BIG-IQ Certificate Manager allows authenticated attackers with high privileges to execute arbitrary commands with scope change. Attackers holding Certificate Manager role credentials can modify configuration objects to run system commands, escalating from administrative interface access to underlying system control. CVSS 8.7 reflects the scope change (S:C) enabling broader impact than typical privileged command injection. No public exploit identified at time of analysis. F5 has released vendor patches per K000160972.

Technical ContextAI

F5 BIG-IP is an application delivery controller (ADC) providing load balancing, SSL/TLS offloading, and web application firewall functions. BIG-IP and BIG-IQ share a common management framework with role-based access control (RBAC) including the Certificate Manager role for SSL/TLS certificate lifecycle operations. This vulnerability exploits CWE-250 (Execution with Unnecessary Privileges) where the Certificate Manager role's configuration modification permissions can be abused to inject commands into configuration objects that are later executed by higher-privileged system processes. The scope change in the CVSS vector (S:C) indicates the attacker can impact resources beyond the vulnerable component's security scope, suggesting execution context escalation from web management interface to underlying operating system with different privilege boundaries.

RemediationAI

Apply vendor-released patches per F5 Security Advisory K000160972 available at https://my.f5.com/manage/s/article/K000160972, which specifies exact patched versions and hotfixes for affected BIG-IP and BIG-IQ releases. Until patching is complete, implement compensating controls: audit all accounts with Certificate Manager role privileges and restrict to minimum necessary personnel with documented business justification; enable enhanced logging for all configuration changes made by Certificate Manager role accounts through BIG-IP's audit logging (auth.info syslog facility); monitor for anomalous configuration object modifications especially targeting mcpd, tmsh, or system configuration files; consider temporarily revoking Certificate Manager role from accounts where certificate operations are not immediately required; implement network segmentation to restrict management interface access to dedicated administrative VLANs with jump host requirements. Note that restricting Certificate Manager role permissions may impact legitimate SSL/TLS certificate renewal operations and require manual administrator intervention for certificate lifecycle tasks. Review all recent Certificate Manager activity prior to patching to identify potential historical compromise.