F5 BIG-IP TMUI Authentication Bypass and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2023-46747)
Executive & SecOps Summary
SECOPS ASSESSMENTF5 BIG-IP systems with network access to the Configuration Utility (TMUI) via the management port and/or Self IP addresses.
Unauthenticated remote attackers can bypass authentication mechanisms and execute arbitrary system commands with root privileges on the target system.
Immediately apply the official F5 security patches or restrict access to the TMUI (port 443) from untrusted networks as a temporary workaround.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
F5 recommends upgrading to a fixed release or hotfix version immediately. Use the following commands to verify your current version and apply the update package.
# Check the current BIG-IP system version and installed hotfixes
tmsh show sys version
# Install the updated ISO image to a target volume (e.g., HD1.2)
tmsh install sys software image BIGIP-17.1.1.1-0.0.2.iso volume HD1.2 create-volume
# Monitor the installation progress
watch tmsh show sys software status2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block all administrative access to the TMUI from untrusted networks. Restrict Port Lockdown settings on Self IPs using the following commands:
# Modify Self IP Port Lockdown settings to 'Allow None' or 'Allow Default'
tmsh modify net self [Self-IP-Name] allow-service none
# Save the configuration changes
tmsh save sys config3. Log Audit & IoC Verification Commands
Inspect the web server and system logs for indicators of compromise (IoCs) related to AJP smuggling and unauthorized TMUI access.
# Scan Apache access logs for suspicious POST requests targeting TMUI endpoints
grep -E '/tmui/|/hsec/' /var/log/httpd/httpd_access.log | grep -i 'POST'
# Audit system logs for unauthorized privilege escalation or unexpected command execution
grep -E 'auth|user|command' /var/log/audit | tail -n 50Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-46747) is a critical authentication bypass and remote code execution (RCE) flaw in the Traffic Management User Interface (TMUI), the web-based management console of F5 BIG-IP. The root cause lies in the request handling logic of the Apache JServ Protocol (AJP) connector used for communication between the frontend Apache HTTP Server proxy and the backend Apache Tomcat application server. Due to insufficient validation of HTTP request headers at the frontend, an attacker can perform 'AJP Smuggling', leading to complete authentication bypass (CWE-288, CWE-306).
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by sending a specially crafted HTTP request to the TMUI management port or Self IP HTTPS service (typically TCP port 443). The frontend web server forwards this request to the backend Tomcat server via the AJP connector. By exploiting the AJP protocol characteristics, the attacker smuggles attributes that mislead the backend into treating the request as an authenticated administrative request originating from localhost. Once authenticated access is established, the attacker targets internal administrative API endpoints to execute arbitrary OS commands with root privileges.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability is actively exploited in the wild. Successful exploitation grants full administrative control over the BIG-IP appliance. This allows attackers to intercept or decrypt network traffic, perform lateral movement within the internal network, harvest sensitive credentials, and cause severe business disruption through denial-of-service (DoS) or complete infrastructure compromise.
Official Vendor Advisories & References
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Frequently Asked SecOps Questions (CVE-2023-46747)
FAQQ1. How critical is CVE-2023-46747 and is it actively exploited in the wild?
CVE-2023-46747 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 96.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-46747?
Primary impacted vendors include f5 across big-ip. Scope summary: F5 BIG-IP versions 17.1.0 through 17.1.1, 16.1.0 through 16.1.4, 15.1.0 through 15.1.10, 14.1.0 through 14.1.5, and 13.1.0 through 13.1.5 (End of Technical Support versions were not evaluated but are likely vulnerable)
Q3. What temporary mitigations or workarounds exist for CVE-2023-46747 before patching?
[Mitigation] Immediately apply the official F5 security patches or restrict access to the TMUI (port 443) from untrusted networks as a temporary workaround. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-46747
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (f5)
View Category →F5 BIG-IP APM OAuth Authorization Server Remote Code Execution (RCE) Vulnerability (CVE-2026-94127)
[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.
Cisco Secure Firewall Management Center (FMC) Authentication Bypass and Root RCE Vulnerability (CVE-2026-20079)
[Affected Scope] Web-based management interface of Cisco Secure Firewall Management Center (FMC) Software
TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
Citrix NetScaler ADC and Gateway Authentication Bypass and RCE Vulnerability (CVE-2026-19490)
[Affected Scope] NetScaler ADC and Gateway versions 14.1 (prior to 73.32) and 13.1 (prior to 63.21)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.