Is CVE-2026-32643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32643 being exploited in the wild.

How severe is CVE-2026-32643?

High severity, with a CVSS score of 8.7, published 13 May 2026.

Which products and versions are affected?

F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Iq Centralized Management Not specified.

Is there a fix for CVE-2026-32643?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-32643 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-32643?

Check whether you run F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32643: F5 BIG-IP and BIG-IQ privilege escalation in Certificate Manager role

CVE-2026-32643 · Severity: high · CVSS 8.7 · Published 2026-05-13

F5 BIG-IP and BIG-IQ systems, which are used to manage and secure enterprise network traffic, contain a vulnerability that could allow a highly privileged user to take full control of the system. An attacker who already has administrative access, specifically with the Certificate Manager role, can bypass intended restrictions to run unauthorized commands. This could lead to a complete compromise of the device, potentially impacting all network traffic and security policies managed by the appliance.

Technologies: F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager, F5 BIG-IQ, F5 Big-Iq Centralized Management. Vendors: F5.

Quick answers

Is CVE-2026-32643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32643 being exploited in the wild.
How severe is CVE-2026-32643?: High severity, with a CVSS score of 8.7, published 13 May 2026.
Which products and versions are affected?: F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Iq Centralized Management Not specified.
Is there a fix for CVE-2026-32643?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-32643 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32643?: Check whether you run F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as 'Execution with Unnecessary Privileges' (CWE-250) exists in F5 BIG-IP and BIG-IQ systems. The flaw allows a highly privileged, authenticated attacker—specifically one assigned at least the Certificate Manager role—to modify configuration objects in a way that facilitates arbitrary command execution. The attack vector is network-based and requires high privileges (PR:H) but no user interaction. Successful exploitation results in a scope change (S:C), allowing the attacker to move from the restricted management role to full system execution. F5 has released advisory K000160972 to address this issue across multiple product modules including LTM, APM, and AFM.

Affected products

F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IP Advanced WAF 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
F5 BIG-IQ Centralized Management Not specified

Timeline

2026-05-13: advisory: Initial publication of the vulnerability advisory

References

https://my.f5.com/manage/s/article/K000160972

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.