CVE-2026-32643

HighCVSS 8.7/10Last modified Jun 29, 2026

Description

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Jun 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326449.8Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.CVE-2026-326456.0Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-326467.5A specific administrative endpoint is accessible without proper authentication, exposing device management functions.CVE-2026-326477.8NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer o CVE-2026-326485.3Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisti CVE-2026-326496.8A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.CVE-2026-32658.8A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the fil CVE-2026-326507.5Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials t CVE-2026-326527.8Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged attacker with console a CVE-2026-326557.8Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain a Least Privilege Violation vulnerability. A low privileged attack CVE-2026-326577.3Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version CVE-2026-326588.8Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote ac