This vulnerability (CVE-2026-32643) in F5 BIG-IP and BIG-IQ products involves execution with unnecessary privileges (CWE-250). An attacker with the Certificate Manager role, which is highly privileged and authenticated, can modify configuration objects to run arbitrary commands on the system. The CVSS v3.1 score is 8.7 (high severity) with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with scope changed. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. No patch or official remediation level is currently documented. The vulnerability is published and reserved as of late April 2026. No known exploits have been reported.

An attacker with the Certificate Manager role can execute arbitrary commands by modifying configuration objects, potentially leading to full compromise of confidentiality and integrity of the affected system. Availability impact is not indicated. The vulnerability requires high privileges and authentication, limiting exposure to users with elevated roles. No exploits are known in the wild, so active exploitation has not been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict assignment of the Certificate Manager role to trusted administrators only and monitor for unauthorized configuration changes. Follow F5's official communications for updates on patches or workarounds.