This vulnerability (CVE-2026-32673) in F5 BIG-IP involves execution with unnecessary privileges (CWE-250) in scripted monitors. Authenticated users with Resource Administrator or Administrator roles can execute arbitrary system commands with higher privileges than intended. In appliance mode deployments, this can allow crossing security boundaries. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact but no availability impact. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. No vendor advisory or patch information is provided, and the vulnerability is not known to be exploited in the wild.

An authenticated attacker with Resource Administrator or Administrator privileges can execute arbitrary system commands with elevated privileges on affected BIG-IP versions. This can compromise confidentiality and integrity of the system. In appliance mode, the attacker may cross security boundaries, potentially increasing the impact. Availability is not affected. Since exploitation requires high privileges, the risk is limited to users with significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Resource Administrator and Administrator roles to trusted personnel only. Monitor for unusual activity related to scripted monitors. No official remediation or temporary fix has been published by the vendor as of now.