The vulnerability of the configuration utilities for BIG-IP software products, such as BIG-IP Access Policy Manager, as well as BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Hybrid Defender, BIG-IP Domain Name System, BIG-IP Fraud Protection Service, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Orchestrator, stems from the possibility of bypassing the authentication process by using an alternative path or channel. This allows attackers to execute arbitrary system commands.

🗓️ 28 Oct 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Authentication bypass in multiple BIG IP products enables remote arbitrary command execution.

Reporter	Title	Published	Views	Family All 50
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	2 Nov 202316:03	–	githubexploit
GithubExploit	Exploit for Injection in Atlassian Confluence_Data_Center	23 Jan 202417:07	–	githubexploit
GithubExploit	Exploit for Injection in Atlassian Confluence_Data_Center	23 Jan 202417:07	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	30 Oct 202315:50	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	1 Nov 202309:31	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	3 Nov 202313:31	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center	5 Nov 202306:45	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	3 Dec 202506:39	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	4 Jul 202504:20	–	githubexploit
GithubExploit	Exploit for Injection in Atlassian Confluence_Data_Center	27 Jul 202307:14	–	githubexploit

Vulners

Node

f5_networks,big-ip_access_policy_managerRange13.1.0–13.1.5

f5_networks,big-ip_advanced_firewall_managerRange13.1.0–13.1.5

f5_networks,big-ip_analyticsRange13.1.0–13.1.5

f5_networks,big-ip_application_acceleration_managerRange13.1.0–13.1.5

f5_networks,big-ip_application_security_managerRange13.1.0–13.1.5

f5_networks,big-ip_fraud_protection_serviceRange13.1.0–13.1.5

f5_networks,big-ip_link_controllerRange13.1.0–13.1.5

f5_networks,big-ip_local_traffic_managerRange13.1.0–13.1.5

f5_networks,big-ip_policy_enforcement_managerRange13.1.0–13.1.5

f5_networks,big-ip_access_policy_managerRange14.1.0–14.1.5

f5_networks,big-ip_advanced_firewall_managerRange14.1.0–14.1.5

f5_networks,big-ip_analyticsRange14.1.0–14.1.5

f5_networks,big-ip_application_acceleration_managerRange14.1.0–14.1.5

f5_networks,big-ip_fraud_protection_serviceRange14.1.0–14.1.5

f5_networks,big-ip_link_controllerRange14.1.0–14.1.5

f5_networks,big-ip_local_traffic_managerRange14.1.0–14.1.5

f5_networks,big-ip_policy_enforcement_managerRange14.1.0–14.1.5

f5_networks,big-ip_application_security_managerRange14.1.0–14.1.5

f5_networks,big-ip_ddos_hybrid_defenderRange14.1.0–14.1.5

f5_networks,big-ip_ddos_hybrid_defenderRange13.1.0–13.1.5

f5_networks,big-ip_ssl_orchestratorRange13.1.0–13.1.5

f5_networks,big-ip_ssl_orchestratorRange14.1.0–14.1.5

f5_networks,big-ip_advanced_firewall_managerRange17.1.0–17.1.0.3

f5_networks,big-ip_application_security_managerRange17.1.0–17.1.0.3

f5_networks,big-ip_link_controllerRange17.1.0–17.1.0.3

f5_networks,big-ip_local_traffic_managerRange17.1.0–17.1.0.3

f5_networks,big-ip_policy_enforcement_managerRange17.1.0–17.1.0.3

f5_networks,big-ip_fraud_protection_serviceRange17.1.0–17.1.0.3

f5_networks,big-ip_ddos_hybrid_defenderRange17.1.0–17.1.0.3

f5_networks,big-ip_ssl_orchestratorRange17.1.0–17.1.0.3

f5_networks,big-ip_access_policy_managerRange17.1.0–17.1.0.3

f5_networks,big-ip_analyticsRange17.1.0–17.1.0.3

f5_networks,big-ip_application_acceleration_managerRange17.1.0–17.1.0.3

f5_networks,big-ip_access_policy_managerRange16.1.0–16.1.4

f5_networks,big-ip_access_policy_managerRange15.1.0–15.1.10

f5_networks,big-ip_advanced_firewall_managerRange15.1.0–15.1.10

f5_networks,big-ip_advanced_firewall_managerRange16.1.0–16.1.4

f5_networks,big-ip_analyticsRange15.1.0–15.1.10

f5_networks,big-ip_analyticsRange16.1.0–16.1.4

f5_networks,big-ip_application_acceleration_managerRange15.1.0–15.1.10

f5_networks,big-ip_application_acceleration_managerRange16.1.0–16.1.4

f5_networks,big-ip_application_security_managerRange15.1.0–15.1.10

f5_networks,big-ip_application_security_managerRange16.1.0–16.1.4

f5_networks,big-ip_ddos_hybrid_defenderRange15.1.0–15.1.10

f5_networks,big-ip_ddos_hybrid_defenderRange16.1.0–16.1.4

f5_networks,big-ip_fraud_protection_serviceRange15.1.0–15.1.10

f5_networks,big-ip_fraud_protection_serviceRange16.1.0–16.1.4

f5_networks,big-ip_link_controllerRange15.1.0–15.1.10

f5_networks,big-ip_link_controllerRange16.1.0–16.1.4

f5_networks,big-ip_local_traffic_managerRange16.1.0–16.1.4

f5_networks,big-ip_local_traffic_managerRange15.1.0–15.1.10

f5_networks,big-ip_policy_enforcement_managerRange15.1.0–15.1.10

f5_networks,big-ip_policy_enforcement_managerRange16.1.0–16.1.4

f5_networks,big-ip_ssl_orchestratorRange16.1.0–16.1.4

f5_networks,big-ip_ssl_orchestratorRange15.1.0–15.1.10

Source	Link
my	www.my.f5.com/manage/s/article/K000137353
praetorian	www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
secpod	www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/
packetstormsecurity	www.packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html
web	www.web.nvd.nist.gov/view/vuln/detail

05 Jun 2026 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 39.8

CVSS 210

EPSS0.96515