9.8 Critical Exploited · ransomware

CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Known to be used

Weakness CWE-288

Description

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products and versions

Product	Affected versions	Fixed in
BIG-IP 17.1	17.1.0 → latest	No fix stated
BIG-IP 16.1	16.1.0 → latest	No fix stated
BIG-IP 15.1	15.1.0 → latest	No fix stated
BIG-IP 14.1	14.1.0 → latest	No fix stated
BIG-IP 13.1	13.1.0 → latest	No fix stated

References

my.f5.com my.f5.com
packetstormsecurity.com packetstormsecurity.com
www.secpod.com www.secpod.com

Timeline

Published October 26, 2023
Added to the KEV catalogue October 31, 2023
Last modified October 21, 2025

The 259 CVEs of BIG-IP →

CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability 9.8 Critical CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts… 8.8 High CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error… 3.1 Low CVE-2026-59762 When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory… 7.5 High

Track this CVE