CVE-2026-32673 Overview
CVE-2026-32673 affects F5 BIG-IP scripted monitors and allows authenticated attackers with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges. The flaw enables crossing the appliance mode security boundary, defeating a key isolation control in hardened BIG-IP deployments. F5 classifies the issue under [CWE-250] (Execution with Unnecessary Privileges). Software versions that have reached End of Technical Support (EoTS) are not evaluated by the vendor advisory.
Critical Impact
Authenticated administrators can break out of appliance mode restrictions and execute commands at a higher privilege level than the management interface should permit.
Affected Products
- F5 BIG-IP (scripted monitors component)
- F5 BIG-IP deployments configured in appliance mode
- BIG-IP versions enumerated in F5 Knowledge Base Article K000161040
Discovery Timeline
- 2026-05-13 - CVE-2026-32673 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-32673
Vulnerability Analysis
BIG-IP scripted monitors allow administrators to define Tcl-based health checks that probe backend pool members. The monitor framework executes these scripts under a system context that holds privileges beyond what the management role should command. An attacker holding the Resource Administrator or Administrator role can craft monitor logic that issues arbitrary shell commands during execution.
In appliance mode, F5 restricts administrators from reaching the underlying operating system shell. This vulnerability bypasses that restriction by using the legitimate scripted monitor execution path as an indirect command channel. The result is a security boundary crossing from the constrained management plane to the host operating system.
The weakness maps to [CWE-250], where a component performs operations with privileges greater than required for its function.
Root Cause
The scripted monitor execution path runs with elevated system privileges rather than dropping to the privilege level of the invoking administrator. Input validation on monitor script content does not prevent commands that escape the intended health-check sandbox. Appliance mode controls are enforced at the user interface and shell layers but not within the monitor execution pipeline.
Attack Vector
Exploitation requires valid credentials for an account with Resource Administrator or Administrator privileges. The attacker authenticates to the BIG-IP management interface, configures or modifies a scripted monitor, and embeds operating system commands inside the monitor script. When the monitor runs, the host executes the embedded commands with elevated privileges, bypassing appliance mode constraints. No user interaction is required beyond the attacker's own authenticated session. Refer to the F5 Knowledge Base Article K000161040 for vendor technical details.
Detection Methods for CVE-2026-32673
Indicators of Compromise
- Unexpected creation or modification of scripted monitors in BIG-IP configuration backups (bigip.conf, bigip_base.conf)
- Audit log entries showing scripted monitor changes from Resource Administrator or Administrator accounts followed by atypical system activity
- Outbound network connections originating from the BIG-IP host process tree during monitor execution windows
- New files, cron entries, or SSH keys appearing on the BIG-IP appliance file system
Detection Strategies
- Review /var/log/audit and /var/log/restjavad-audit.0.log for monitor create or modify events correlated with administrator logins
- Baseline the expected set of scripted monitors and alert on any deviation
- Hunt for Tcl monitor scripts containing shell metacharacters, exec, or external command invocations
- Forward BIG-IP audit and system logs to a centralized analytics platform for cross-correlation with identity events
Monitoring Recommendations
- Alert on every privileged role assignment change for BIG-IP administrative accounts
- Monitor management interface authentication events for anomalous source IPs or off-hours access
- Track process execution on BIG-IP hosts where supported, focusing on child processes spawned by monitor daemons
- Integrate BIG-IP telemetry with broader SIEM or data lake pipelines for retrospective hunting
How to Mitigate CVE-2026-32673
Immediate Actions Required
- Apply the fixed BIG-IP versions listed in F5 Knowledge Base Article K000161040 on all affected appliances
- Audit all accounts holding Resource Administrator or Administrator roles and remove unnecessary privileges
- Rotate credentials for any administrative account that may have been exposed
- Review existing scripted monitors for unauthorized modifications and remove any that are not required
Patch Information
F5 has published remediation guidance and fixed software versions in K000161040. Versions at End of Technical Support are not covered and require migration to a supported branch. Customers should validate patches in a staging environment before production deployment.
Workarounds
- Restrict assignment of the Resource Administrator and Administrator roles to a minimal set of operators
- Enforce multi-factor authentication on the BIG-IP management interface
- Limit management plane access to dedicated administrative networks via firewall rules
- Disable or remove unused scripted monitors and review remaining scripts for least-privilege command usage
# Configuration example: restrict management access and list privileged users
tmsh list auth user one-line | grep -E "role (resource-admin|admin)"
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
