F5 BIG-IP CVE-2026-32673

Exploitation requires the attacker to hold either the Resource Administrator or Administrator role within BIG-IP; unauthenticated users cannot exploit this vulnerability. The attacker must have network access to BIG-IP's management interface (typically HTTPS on port 443). The vulnerability is triggered when the attacker creates, modifies, or executes a scripted monitor with malicious commands embedded in the monitor script definition. No special non-default configuration is required - the scripted monitors feature is standard in BIG-IP. Exploitation is most impactful in appliance mode deployments where security boundaries are more strictly defined; non-appliance modes may have different blast radius. Standard BIG-IP configurations with default scripted monitor settings are vulnerable.

This vulnerability presents moderate real-world risk despite the 6.5 CVSS score, which reflects the authentication requirement (PR:H) that significantly limits exposure. CVSS vector AV:N/AC:L indicates network accessibility with low attack complexity, but the high privilege prerequisite (Resource Administrator or Administrator role) is a critical mitigating factor - only trusted personnel have these roles. The vulnerability is not confirmed as actively exploited (no KEV status provided), and no public exploit code availability is documented. EPSS exploitation probability data is not available, limiting quantitative risk modeling. The primary concern is insider threats or lateral movement by compromised administrative accounts. In appliance mode deployments specifically, the ability to cross security boundaries elevates impact beyond standard privilege escalation. Organizations should prioritize patching in appliance mode environments and tightly control administrative access. The lack of active exploitation signals suggests this is not an immediate critical threat, but the combination of command execution capability and appliance mode implications warrants timely remediation.

An authenticated administrator with Resource Administrator role logs into BIG-IP and creates or modifies a scripted monitor, embedding arbitrary system commands in the monitor script payload. When the monitor executes on the BIG-IP system, the commands run with elevated privileges beyond what the administrator's role nominally permits, potentially allowing them to read sensitive configuration files, modify system settings, or install persistent backdoors. In appliance mode, this could allow the attacker to break out of the intended administrative sandbox and compromise underlying system integrity.