8.8 High Exploited

CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-89

Description

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products and versions

Product	Affected versions	Fixed in
BIG-IP 17.1	17.1.0 → latest	No fix stated
BIG-IP 16.1	16.1.0 → latest	No fix stated
BIG-IP 15.1	15.1.0 → latest	No fix stated
BIG-IP 14.1	14.1.0 → latest	No fix stated
BIG-IP 13.1	13.1.0 → latest	No fix stated

References

my.f5.com my.f5.com
www.secpod.com www.secpod.com

Timeline

Published October 26, 2023
Added to the KEV catalogue October 31, 2023
Last modified October 21, 2025

The 259 CVEs of BIG-IP →

CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability 9.8 Critical CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts… 8.8 High CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error… 3.1 Low CVE-2026-59762 When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory… 7.5 High

Track this CVE