CVE-2023-46747Vulnerability
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
Reported by 3 independent sources · first reported by Recorded Future · last reported
Last reported 28 days ago
Fix due 21 Nov 2023
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry“…in this campaign’s arsenal, prioritizing Sophos XG (CVE-2022-1040), WordPress (CVE-2026-63030), FortiOS (CVE-2024-55591), F5 BIG-IP (CVE-2023-46747), SAP NetWeaver (CVE-2025-31324), and Roundcube (CVE-2025-49113 / CVE-2025-25257).”
-
Someone's attacking a critical 0-day RCE in F5 BIG-IP APM“… particular group or country, but a year earlier Google's Mandiant threat hunters linked exploitation of the critical F5 BIG-IP flaw CVE-2023-46747 to UNC5174, an access broker it assessed with moderate confidence as operating from China.”
-
August 2026 CVE Landscape“CVE-2023-46747”
-
June 2026 CVE Landscape“CVE-2023-46747”
Indicators reported together
named in the same reportsAlso named with it: CVE-2025-49113, CVE-2026-63030, CVE-2026-12569, CVE-2022-1040, CVE-2022-27925, CVE-2024-55591, CVE-2025-31324, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-0300, CVE-2026-33825
Thanks — we review every report.