Yes. CISA added CVE-2023-46747 to its Known Exploited Vulnerabilities catalogue on 31 October 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.
What this says about an active F5 BIG-IP exploit path
CVE-2023-46747 is not a theoretical authentication flaw when it has been placed in CISA’s Known Exploited Vulnerabilities catalogue. For practitioners, that changes the question from “is it vulnerable?” to “is the management plane exposed, and has it already been reached?” Internet-facing appliances and administrative interfaces deserve immediate attention, especially when the product sits at a trust boundary.
Because the issue is an authentication bypass in a management utility, the practical concern is unauthorized access to configuration and control functions. That can expose secrets, routes, certificates, and session-bearing administration pathways, even before any visible service disruption appears. Edge Device Security Guide is a useful companion when you are checking exposed appliance management surfaces and log coverage.
For teams using BIG-IP as a gateway or load balancer, the real-world impact is often broader than the management console itself. A successful bypass can become a foothold for persistence, traffic manipulation, or follow-on credential theft if the appliance is trusted by adjacent systems. That is why the right response sequence is exposure check, remediation, and then compromise review, not the reverse.
What to do before and after remediation
Start by confirming whether the vulnerable BIG-IP management surface is reachable from networks that should never have had direct access. If the answer is yes, treat the device as a priority asset, because an exposed administrative interface on an edge appliance has a much shorter path to impact than a typical internal server. Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide both support the urgent triage mindset here.
If patching or mitigation must wait, reduce exposure immediately by restricting administrative reachability, tightening management-plane access, and reviewing whether the appliance is unnecessarily reachable from broader trust zones. In practice, this is a containment problem first and a patching problem second. The goal is to shrink the blast radius while you schedule the fix.
After remediation, review logs and related telemetry for signs that the device was used before you closed the window. On edge appliances, the most valuable evidence is often indirect, such as unexpected configuration changes, new sessions, unusual source addresses, or authentication events that do not fit normal admin behavior. A device-level review is often more useful than waiting for a host-based alert that never arrives.
Why this class of flaw is operationally dangerous
An authentication bypass on an appliance management interface is dangerous because it targets the control plane, not just a user-facing application. That means a single exploit can unlock a disproportionately large amount of trust, especially where the appliance brokers traffic for many downstream services. CISA’s KEV catalogue is the clearest public signal that defenders should treat this as an active exploitation problem, not a low-priority bug. CISA Known Exploited Vulnerabilities Catalog and NIST National Vulnerability Database are the right reference points for authoritative vulnerability tracking.
The failure mode is especially serious when administrators assume the device is safe because it sits behind a perimeter or because access is “only for internal use.” That assumption breaks down once the management interface is reachable, credentials are bypassed, or the appliance has been used as a staging point for later movement. CVE Program is the canonical place to anchor the record identity before you validate your exposure and mitigation plan.
Any environment that depends on the appliance for authentication, routing, or access mediation should treat successful exploitation as a potential control failure with downstream impact, not as a narrow product issue. The security decision is whether the appliance still deserves trust after exposure, or whether the safer assumption is that it may already have been abused.
Risk and Threat Considerations
This type of flaw matters because attackers do not need a password if the management path can be bypassed. On an internet-facing edge appliance, that can turn a single vulnerable interface into a privileged entry point for reconnaissance, configuration theft, persistence, or traffic redirection.
Failure mechanism: The management utility accepts requests that should have been blocked by authentication, allowing an attacker to reach administrative functions and potentially expose or alter trusted device settings.
Impact: Once the control plane is reachable, the attacker may be able to change configuration, harvest sensitive material, or use the appliance as a launch point for broader compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Active exploitation of an auth bypass demands access control and authentication hardening on the appliance |
| Recommendation — Restrict administrative access and require strong authentication for management interfaces. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The issue is an authentication bypass on a management plane used by organizational admins |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on analyzing logs for abnormal administrative activity | |
| Recommendation — Enforce robust administrator authentication for device management access. Review appliance and supporting logs for signs of prior compromise. | ||
| ISO/IEC 27001:2022 | A.8.5 — Secure authentication | The flaw directly undermines authentication to a security-relevant management interface |
| Recommendation — Harden authentication on management utilities and validate control effectiveness. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Mitigation centers on reducing appliance exposure and hardening administrative access |
| Recommendation — Lock down exposed management surfaces and remove unnecessary administrative reachability. | ||
| OWASP ASVS | V6 — Authentication | The vulnerability is an authentication bypass, making authentication requirements central to the fix |
| Recommendation — Verify that administrative authentication cannot be bypassed on security-critical interfaces. | ||
Practitioner Guidance
What to verify: Confirm whether the BIG-IP management interface is exposed outside the smallest necessary admin network, and verify whether any access paths bypass normal administrative controls. If exposure exists, treat it as an urgent remediation candidate rather than a routine patch item.
Decision rule: If you cannot patch immediately, contain first, then validate logs and configuration history before assuming the system is clean. If you can patch quickly, still perform a retrospective check, because active exploitation may have occurred before the fix was applied.
What practitioners underestimate: Appliances that sit at the edge are often trusted implicitly by downstream systems, which means compromise can have wider consequences than the initial vulnerability suggests. The key judgement is not simply whether the bug is fixed, but whether the device remained trustworthy during the exposure window.
Practitioner takeaway: For an actively exploited appliance flaw, the highest-value work is to prove exposure, reduce reachability, and look for prior misuse before you assume patching alone has solved the problem.
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2023-46747 (F5 BIG-IP Configuration Utility Authentication Bypass)?
- CVE-2023-46747 (F5 BIG-IP Configuration Utility Authentication Bypass)
- How do you patch or mitigate CVE-2023-46748 (F5 BIG-IP Configuration Utility SQL Injection)?
- Is CVE-2022-1388 (F5 BIG-IP Missing Authentication) being exploited in the wild?