This vulnerability (CVE-2026-32673) in F5 BIG-IP arises from execution with unnecessary privileges (CWE-250) in scripted monitors. Authenticated users with Resource Administrator or Administrator roles can execute arbitrary system commands with higher privileges than intended. In appliance mode deployments, this can lead to crossing security boundaries, potentially increasing the impact of the exploit. The vulnerability affects several recent BIG-IP versions. No official patch or remediation guidance has been published by F5 as of the current data. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an authenticated user with elevated roles to execute arbitrary system commands with higher privileges, potentially leading to unauthorized access or control beyond intended limits. In appliance mode, this can result in crossing security boundaries, increasing the risk of system compromise. The vulnerability does not impact availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Resource Administrator and Administrator roles to trusted personnel only and monitor for suspicious activity related to scripted monitors. Follow any future vendor advisories for updates on patches or mitigations.