# F5 BIG-IP RCE via CVE-2023-46747 — Mitigation and Exploitation Guide

> Exploit analysis of the critical F5 BIG-IP authentication bypass (CVE-2023-46747). Learn how to detect webshell deployment and apply essential security patches.

- Published: 2026-03-30T12:31:42.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2023-46747, F5 BIG IP, RCE, Auth Bypass, Active Exploitation
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-f5-big-ip-flaw-in-attacks-patch-now/
- Canonical: https://runtimerebel.com/blog/f5-big-ip-rce-via-cve-2023-46747-mitigation-and-exploitation-guide

## Key points

- Immediate impact: Unauthenticated attackers are exploiting an authentication bypass to execute arbitrary commands and deploy persistent webshells on BIG-IP devices.
- Affected systems: Vulnerable configurations include F5 BIG-IP versions 13.x through 17.x with the Configuration utility exposed to the internet.
- Remediation: Apply security patches immediately or restrict management interface access to trusted internal networks only.

## Overview of the BIG-IP Authentication Bypass

F5 has issued an urgent warning regarding the active exploitation of a critical [CVE](/glossary#cve) affecting its BIG-IP networking devices. The vulnerability, tracked as [CVE-2023-46747](/cve/cve-2023-46747), carries a [CVSS](/glossary#cvss) score of 9.8 and allows unauthenticated attackers to achieve [RCE](/glossary#rce) on vulnerable systems. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-f5-big-ip-flaw-in-attacks-patch-now/), threat actors are leveraging this flaw to deploy webshells, providing them with persistent access to the underlying operating system of the appliance.

The vulnerability resides in the BIG-IP Configuration utility (TMUI). When an attacker has network access to the system through the management port or self IP addresses, they can bypass authentication protocols to execute arbitrary system commands. This level of access effectively grants full administrative control, enabling [Lateral Movement](/glossary#lateral-movement) within the internal network and the potential for large-scale data exfiltration.

## Technical Analysis: From Auth Bypass to RCE

The technical root cause of CVE-2023-46747 is an Apache JServ Protocol (AJP) request smuggling vulnerability. This occurs due to a discrepancy in how the frontend Apache web server and the backend Tomcat engine handle specific HTTP requests. By crafting a malicious request that exploits this smuggling vector, an attacker can manipulate the internal communication of the BIG-IP system to impersonate an authenticated user.

Once the authentication is bypassed, the attacker can access the Traffic Management Shell (tmsh) via the management API. From this interface, they can execute bash commands with root privileges. Security researchers have observed [APT](/glossary#apt) groups and opportunistic attackers using this capability to install persistent backdoors. Because BIG-IP devices often sit at the edge of the network and handle decrypted traffic, a compromise here is catastrophic for the organization's security posture.

### ## Detecting CVE-2023-46747 Exploit Activity

Organizations are prioritizing how to detect CVE-2023-46747 exploit attempts within their environment to determine if a compromise has already occurred. A primary [IoC](/glossary#ioc) is the presence of unusual entries in the `/var/log/httpd/access_log` file. Specifically, administrators should look for POST requests to `/mgmt/tm/util/bash` originating from unexpected or external IP addresses.

Furthermore, the deployment of webshells often involves creating files in directories such as `/var/www/html/` or `/usr/local/www/`. A [SOC](/glossary#soc) should monitor for any unauthorized modifications to these directories. If [EDR](/glossary#edr) or file integrity monitoring is available on the appliance, alerts for new executable files or scripts should be treated as high-priority incidents. Attackers may also create new administrative accounts to maintain access, so reviewing the `tmsh` command history and local user lists is a necessary step in the investigation process.

## Remediation and Mitigation Strategies

The most effective response is the immediate application of the official F5 security updates. The following F5 BIG-IP CVE-2023-46747 patch guidance outlines the specific versions requiring updates:

*   BIG-IP 17.x: Upgrade to 17.1.0.3 or later
*   BIG-IP 16.x: Upgrade to 16.1.4.1 or later
*   BIG-IP 15.x: Upgrade to 15.1.10.2 or later
*   BIG-IP 14.x: Upgrade to 14.1.5.6 or later
*   BIG-IP 13.x: Upgrade to 13.1.5.1 or later

If immediate patching is not feasible, defenders must implement mitigating RCE in F5 BIG-IP systems by restricting access to the Configuration utility. This can be achieved by blocking all traffic to the management port (typically TCP 443 or 8443) from the public internet and restricting self IP access to trusted internal management subnets only. F5 has also provided a mitigation script for certain versions that disables the vulnerable AJP service, though this should be considered a temporary measure until a full patch can be applied. Following these steps will significantly reduce the attack surface and prevent unauthorized [C2](/glossary#c2) communication from being established.

**Related:** [CVE-2026-33017: Critical Langflow RCE Exploited within 20 Hours](/blog/cve-2026-33017-critical-langflow-rce-exploited-within-20-hours), [CVE-2025-53521: CISA Warns of Active F5 BIG-IP APM RCE Exploitation](/blog/cve-2025-53521-cisa-warns-of-active-f5-big-ip-apm-rce-exploitation)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/f5-big-ip-rce-via-cve-2023-46747-mitigation-and-exploitation-guide