CVE-2026-32673: F5 BIG-IP privilege escalation in scripted monitors

CVE-2026-32673 · Severity: high · CVSS 8.7 · Published 2026-05-13

A security vulnerability has been identified in F5 BIG-IP devices, which are widely used to manage and secure enterprise network traffic. An authorized administrator could exploit this flaw to run unauthorized commands with elevated system privileges. In certain high-security configurations, this could allow an attacker to bypass critical security boundaries and gain deeper control over the appliance.

Technologies: F5 BIG-IP, F5 BIG-IP Advanced WAF, F5 BIG-IP DNS, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Local Traffic Manager. Vendors: F5.

Quick answers

Is CVE-2026-32673 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32673 being exploited in the wild.
How severe is CVE-2026-32673?
High severity, with a CVSS score of 8.7, published 13 May 2026.
Which products and versions are affected?
F5 BIG-IP All versions prior to EoTS (End of Technical Support); F5 BIG-IP Advanced WAF 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 BIG-IP DNS 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0; and 2 more.
Is there a fix for CVE-2026-32673?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-32673 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32673?
Check whether you run F5 BIG-IP, F5 BIG-IP Advanced WAF, F5 BIG-IP DNS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as 'Execution with Unnecessary Privileges' (CWE-250) exists in F5 BIG-IP scripted monitors. An authenticated attacker assigned the Resource Administrator or Administrator role can exploit this to execute arbitrary system commands with higher privileges than intended. In appliance mode deployments, this flaw facilitates a security boundary crossing. The attack vector is network-based, requiring high privileges but no user interaction. Affected versions include the 16.1.x and 17.5.x branches, as well as version 21.0.0. F5 has released advisory K000161040 to address the issue.

Affected products

  • F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
  • F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
  • F5 BIG-IP Advanced WAF 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
  • F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0
  • F5 BIG-IP DNS 16.1.0 - 16.1.6, 17.5.0 - 17.5.1, 21.0.0

Timeline

  • 2026-05-13: advisory: Initial publication of the vulnerability advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.