Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-11-21. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Their job against us isn't map scraping. It's commodity mass-exploitation: • PHPUnit CVE-2017-9841 (64) • F5 BIG-IP CVE-2023-46747 • Apache CVE-2021-42013 • NetScaler SAML, PHP-CGI UAs: spoofed iPhone + Mac Chrome, libredtail-http. Nothing announces itself honestly.
Cytellite recent detection targeting CVE-2023-46747 — Tamatiya EOOD Visit -- https://cti.loginsoft.com/ip/79.124.58.130 #Loginsoft #Cytellite #Cybersecurity #CVE202346747 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/JvLsAz812a
Post summary
Cytellite reports a recent detection of attacks targeting CVE-2023-46747, indicating that this vulnerability is actively exploited in the wild.
F5 BIG-IP has had hundreds of CVEs over its 25+ year run (F5 vendor total ~300 per CVE databases, vast majority tied to BIG-IP products/modules). At least 5-6 major ones actively exploited in the wild: CVE-2020-5902, CVE-2021-22986, CVE-2022-1388, CVE-2023-46747, plus batches like 40+ in 2022 and 44 in 2025. This latest CVE-2025-53521 makes another KEV entry. Keep patching!
Post summary
The post lists multiple F5 BIG‑IP CVEs, emphasizing that several are actively exploited in the wild and urging users to patch, specifically noting the latest CVE‑2025‑53521’s inclusion as a KEV entry.
20 of 20 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | f5 | big-ip_access_policy_manager | - | - | - |
| App | f5 | big-ip_advanced_firewall_manager | - | - | - |
| App | f5 | big-ip_advanced_web_application_firewall | - | - | - |
| App | f5 | big-ip_analytics | - | - | - |
| App | f5 | big-ip_application_acceleration_manager | - | - | - |
| App | f5 | big-ip_application_security_manager | - | - | - |
| App | f5 | big-ip_application_visibility_and_reporting | - | - | - |
| App | f5 | big-ip_automation_toolchain | - | - | - |
| App | f5 | big-ip_carrier-grade_nat | - | - | - |
| App | f5 | big-ip_container_ingress_services | - | - | - |
| App | f5 | big-ip_ddos_hybrid_defender | - | - | - |
| App | f5 | big-ip_domain_name_system | - | - | - |
| App | f5 | big-ip_fraud_protection_services | - | - | - |
| App | f5 | big-ip_global_traffic_manager | - | - | - |
| App | f5 | big-ip_link_controller | - | - | - |
| App | f5 | big-ip_local_traffic_manager | - | - | - |
| App | f5 | big-ip_policy_enforcement_manager | - | - | - |
| App | f5 | big-ip_ssl_orchestrator | - | - | - |
| App | f5 | big-ip_webaccelerator | - | - | - |
| App | f5 | big-ip_websafe | - | - | - |