CVE-2023-46747: F5 BIG-IP configuration utility authentication bypass allows command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution on a widely deployed edge appliance, with KEV listing, known ransomware use, and near-maximum EPSS.

What it is

Undisclosed requests can bypass authentication in the BIG-IP configuration utility, letting a network-positioned attacker execute arbitrary system commands. The flaw is a missing/alternate-path authentication weakness (CWE-288, CWE-306) affecting a wide range of BIG-IP modules. It matters because the management interface is a high-value control plane and the record shows active exploitation and ransomware use.

Impact

An attacker gains unauthenticated remote command execution on the BIG-IP system, giving full control of the device and its traffic handling. That can lead to configuration tampering, traffic interception or disruption, and use of the appliance as a foothold into the network.

Attack surface

Reached over the network via the management port and/or self IP addresses; the CVSS vector shows no privileges and no user interaction required. Only network access to the management interface is needed.

Exploitation

Listed in CISA KEV with a 2023-10-31 addition and known ransomware campaign use, and EPSS 30-day probability is about 0.965 (99.9th percentile). References are tagged Exploit, confirming public exploit material exists.

What to do

• Apply the F5 vendor fix per K000137353 as the first action; do not delay for compensating controls.
• If patching is not immediately possible, restrict management port and self IP access to trusted administrative networks only.
• Discontinue use of the product if vendor mitigations are unavailable, per CISA required action.
• Review and rotate credentials and inspect device configuration for unauthorized changes after exposure.
• Confirm EoTS software versions are upgraded, since the record states those versions are not evaluated.

Detection

• Monitor management interface and self IP logs for unexpected or malformed requests to the configuration utility.
• Alert on new or unusual processes, shell activity, or outbound connections originating from the BIG-IP appliance.
• Audit configuration changes and administrative actions for entries not tied to a known administrator session.
• Hunt for indicators tied to the published exploit chain (AJP smuggling) in network and appliance logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.