Is CVE-2023-46748 (F5 BIG-IP Configuration Utility SQL Injection) being exploited in the wild?

Yes. CISA added CVE-2023-46748 to its Known Exploited Vulnerabilities catalogue on 31 October 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands.

What being “exploited in the wild” means for this CVE

CISA’s KEV listing is the key signal here. When a CVE appears in that catalogue, defenders should treat it as an actively exploited issue, not a theoretical weakness. For CVE-2023-46748, the practical question is whether any BIG-IP management plane exposure still exists and whether the appliance can be reached by an authenticated attacker from a network path that should not exist.

The broader pattern is common in appliance and management-plane bugs: the issue is not just the code flaw, but the fact that the vulnerable interface often sits on a high-trust boundary. That is why edge-device hardening and exposure reduction matter as much as the vulnerability itself; see NHIMG’s Edge Device Security Guide for the management-plane, logging and appliance-exposure controls that shape real-world risk.

How to confirm exposure and reduce attack surface

Start by confirming whether any BIG-IP instance is reachable through the management port or self IP addresses in a way that allows administrative access from untrusted networks. That check matters because this vulnerability is only exploitable where the management interface is exposed enough for an authenticated attacker to reach it, so network segmentation and access restrictions are the first meaningful triage steps.

Then verify whether your inventory includes every BIG-IP appliance, especially older or exception-handled systems that may have escaped normal patch workflows. The most useful next action is to compare your estate against the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog, because KEV status is what turns a vulnerability into an operational priority.

If you need a general prioritisation model for deciding which exposed vulnerabilities move first, NHIMG’s Vulnerability Management Guide is useful for mapping KEV status, scan coverage and remediation sequencing into a workable process.

Containment, patching, and what to do if you cannot fix immediately

The preferred response is straightforward: apply the vendor fix or mitigation as soon as the approved maintenance path allows. For appliance vulnerabilities that sit on a management plane, delaying remediation is rarely neutral, because a single exposed interface can provide a durable foothold for command execution or lateral movement.

If patching must wait, narrow access aggressively. Restrict management reachability to trusted administrative networks, remove unnecessary exposure of self IP paths, and ensure the appliance is not reachable from broad user or contractor segments. If a compensating control is being used instead of the fix, it should be treated as temporary and documented with an explicit expiry date.

For SQL injection specifically, the underlying lesson is that the vulnerable interface can turn trusted input into command execution. NHIMG’s SQL Injection Prevention Guide is relevant where teams want a deeper view of parameterisation, blind SQLi and the privilege assumptions that make injection bugs operationally dangerous.

Risk and Threat Considerations

Because this CVE is in KEV, the risk is not abstract. The main threat is that an authenticated attacker with network access to the management plane can abuse the SQL injection flaw to execute commands on a device that often has broad trust and visibility inside the environment.

Failure mechanism: The attacker combines valid access with a vulnerable management interface, uses injected SQL to pivot into command execution, and then leverages the appliance’s privileged position to expand impact or maintain persistence.

Impact: A successful exploit can expose configuration data, disrupt traffic handling, and create a foothold on a high-value network control device; if the appliance also stores sensitive operational data, the blast radius can extend well beyond the local bug.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	BIG-IP exposure and hardening depend on secure configuration of the appliance and its management surface.
	CIS-7 — Continuous Vulnerability Management	The CVE is KEV-listed, so prioritised identification and remediation are central.
Recommendation — Harden the BIG-IP management plane and remove unnecessary exposure paths. Track KEV-listed appliance flaws and remediate them on an urgent SLA.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires timely remediation of a known exploitable software flaw.
	AC-17 — Remote Access	Exploitation depends on network access to the management plane, so remote access restriction is material.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation review depends on logs from the vulnerable appliance and adjacent controls.
Recommendation — Remediate the BIG-IP vulnerability using the vendor fix or approved mitigation. Restrict management access to approved administrative networks and paths. Review appliance and access logs for suspicious management-plane activity.

Practitioner Guidance

What to verify: Confirm whether the BIG-IP management interface is reachable from any non-administrative network and whether compensating controls are actually enforced at the network layer, not just assumed in policy.

Escalation / exception: If the device is internet reachable, or if you cannot prove that only a tightly controlled administrative population can reach it, treat the case as urgent and escalate immediately rather than waiting for a routine patch window.

What practitioners underestimate: Appliance vulnerabilities often become more serious after exploitation than ordinary server bugs because the compromised system may hold management credentials, routing context, or configuration visibility that attackers can reuse elsewhere.

Practitioner takeaway: For KEV-listed management-plane flaws, exposure reduction and rapid remediation are both required; one without the other leaves a high-trust device available for reuse by an attacker.