How do you patch or mitigate CVE-2023-46747 (F5 BIG-IP Configuration Utility Authentication Bypass)?

CISA’s required action for CVE-2023-46747 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of F5 BIG-IP Configuration Utility in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What to verify before you touch the appliance

Start by inventorying every F5 BIG-IP Configuration Utility instance and confirming whether any are internet reachable, because the fastest way to miss this issue is to treat it as a single device problem rather than an estate problem. For edge-facing appliances, configuration drift and forgotten management exposure often matter as much as the patch itself, which is why NHI Management Group’s Edge Device Security Guide is useful for the surrounding operational context.

Then check whether your patch path is direct or constrained by maintenance windows, change freezes, clustering, or vendor-supported mitigations. A vulnerable management plane can be more sensitive than the traffic it brokers, so confirm which systems can be updated immediately and which need temporary isolation or access restriction first.

Finally, verify whether the product is already in a condition where continuing to operate it is acceptable. If you cannot apply the vendor update or documented mitigation, the practical decision is to remove internet exposure first and then plan removal from service if needed.

How to apply the fix or mitigation safely

The preferred action is to apply the vendor security update or the vendor-documented mitigation exactly as instructed, then validate that the Configuration Utility is no longer exposed in the vulnerable state. Do not substitute an informal workaround for the vendor path unless the advisory explicitly allows it, because management interfaces are easy to misconfigure and easy to re-expose later.

For appliances that cannot be patched immediately, reduce attack surface before you defer anything else. Put the management interface behind trusted administrative networks, restrict source IPs, remove unnecessary remote reachability, and make the emergency access path smaller rather than more convenient. For this class of issue, the control objective is to stop unauthorised access to the administration plane, not merely to delay exploitation.

If you are already in a patch queue, use the opportunity to confirm related security basics on the same platform, especially logging, administrative access paths, and any other exposed management services. Internet-facing appliances tend to accumulate exceptions over time, and the same conditions that leave a configuration utility reachable can leave other services exposed too.

What to do if the appliance may already be compromised

If the vulnerable utility was reachable before you mitigated it, treat that exposure as a possible pre-compromise condition. Review authentication, administrative activity, configuration changes, and any unusual access to the management plane, especially around the time the system was exposed.

Look for signs that the attacker moved from the management surface into configuration data, session state, or downstream services. If the appliance participated in authentication, load balancing, or proxying for other systems, assess whether credentials, tokens, or admin sessions could have been observed or reused. That is where this class of bypass often becomes a broader incident rather than a single vulnerable host.

Where evidence suggests compromise, rotate any credentials or secrets that the appliance could have exposed or mediated, and review whether any administrative sessions need to be revoked. If the device was used as a control point for multiple services, broaden the investigation to the systems it managed rather than stopping at the appliance itself.

Risk and Threat Considerations

An authentication bypass in a management interface is high-value because it targets the administrative boundary, not the user-facing layer. If the interface is reachable from untrusted networks, an attacker may be able to gain privileged access without needing valid credentials, which can turn a single weakness into device takeover, configuration tampering, or a pivot into adjacent systems.

Failure mechanism: The vulnerable Configuration Utility can be exposed to unauthorised requests, allowing an attacker to bypass the intended authentication check and interact with the administrative surface.

Impact: The result can be device compromise, unauthorized configuration changes, interception or redirection of traffic, and broader exposure if the appliance sits on a critical network path or holds sensitive administrative trust.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	CVE-2023-46747 can expose admin access paths and secrets.
	AC-17 — Remote Access	The issue centers on remote reachability to a management utility.
Recommendation — Rotate affected credentials and revoke exposed sessions after remediation. Restrict administrative access paths to trusted networks only.
CIS Controls v8	CIS-6 — Access Control Management	Mitigation requires limiting who can reach and use the appliance utility.
Recommendation — Remove unnecessary administrative exposure and enforce tight access restrictions.
ISO/IEC 27001:2022	A.8.9 — Configuration management	The fix depends on applying vendor guidance and controlling appliance exposure.
Recommendation — Apply approved configuration changes and verify the appliance returns to a secure state.
NIST CSF 2.0	PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited	Exploitation may expose administrative credentials or sessions.
Recommendation — Revoke exposed access and verify admin identity controls after remediation.

Practitioner Guidance

What to prioritise: Patch or apply the vendor mitigation on every exposed instance first, then isolate any system that cannot be updated immediately. For this issue, exposure reduction is part of the fix, not a backup plan.

What to verify: Confirm both the management reachability state and the post-change service state. A device is not safely remediated until you have checked that the vulnerable interface is no longer reachable in the way an attacker would use it.

Escalation / exception: If the vendor path cannot be applied, treat continued internet exposure as an exception requiring rapid business approval, compensating controls, and a removal plan. Do not let “temporarily unpatched” become the default operating state.

Practitioner takeaway: With management-plane bypasses, the real decision is not patch versus wait, it is whether the appliance can remain trusted at all until the trust boundary is restored.