# CASCA evidence receipt — CVE-2023-46747 - Generation: `gen-409cbd0c74ff4feb70e4944e6b98ce40` - As known: 2026-07-21T08:13:17.697275+00:00 - Comparison: gen-56ccdaf914f7b4be95b689ccae7dc20d - Score policy: public-priority-v1.0.1 - Conflict: not observed in this generation ## Source assertions - **CISA-ADP** (independent_enrichment): container — CISA ADP Vulnrichment - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2023-46747 - **CVE** (derivative_copy): container — CVE Program Container - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2023-46747 - **f5** (original_assertion): container — BIG-IP Configuration utility unauthenticated remote code execution vulnerability - Observed: 2026-07-19T04:27:06.398189+00:00 - Citation: https://www.cve.org/CVERecord?id=CVE-2023-46747 - **CISA KEV** (original_assertion): observed_exploitation — F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability - Observed: 2026-07-19T04:54:04.25158+00:00 - Citation: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - **FIRST EPSS** (original_assertion): model_probability — Probability 0.965150000000; percentile 0.998750000000 - Observed: 2026-07-19T04:54:35.756809+00:00 - Citation: https://www.first.org/epss/data_stats.html ## CVSS assessments - **nvd@nist.gov** (Primary, CVSS 3.1): 9.8 — score eligible - Evidence class: nvd_enrichment_exact; source rank: 0 - Validation: valid_match - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` - **f5sirt@f5.com** (Secondary, CVSS 3.1): 9.8 — score eligible - Evidence class: exact_record_cna; source rank: 1 - Validation: valid_match - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` - **f5** (unknown, CVSS 3.1): 9.8 — display only - Evidence class: direct_cve_record_display_only; source rank: not applicable - Validation: display-only direct record assessment - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` ## Applicability scope - **F5 · BIG-IP** (direct_source; unknown) - Versions: [{"status": "affected", "version": "17.1.0", "lessThan": "*", "versionType": "semver"}, {"status": "affected", "version": "16.1.0", "lessThan": "*", "versionType": "semver"}, {"status": "affected", "version": "15.1.0", "lessThan": "*", "versionType": "semver"}, {"status": "affected", "version": "14.1.0", "lessThan": "*", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "*", "versionType": "semver"}] - **f5 · big-ip_access_policy_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-fe8f45eed4bb3ac6e69f6f6fbf87e9e25862951e870386e176dca756ebfdb2cb` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_advanced_firewall_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-c611bfdeac48cac2141d0aebba0e7ba6ff1c599d72cfe95a76f1db1b7fe68b36` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_advanced_web_application_firewall** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-3159127811fadcfbf55e58810b397c704a5ecb216e89a6fccc26cab6944674c7` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*` - **f5 · big-ip_analytics** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-000cb533806b78ef860fa6bff163646e9d5756ef6c2d4d7d222692c4cd4c943f` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*` - **f5 · big-ip_application_acceleration_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-bcf09b1e7f256f8ae475f16dc9eb0c89893ad01b1d9c94b66d17ac875578a078` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_application_security_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-ba5b29ee89c2340743c5ed2999e757bf44af0086b8b527afdbbe3f8a626803da` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_application_visibility_and_reporting** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-e7831dd1502c92cf4956b2496298fff48f6f919ba0502487bde1ee5ad5c98016` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*` - **f5 · big-ip_automation_toolchain** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-b499054f70813299757594ac36607b49f4bcc0b7683d3f39d7ade03e99013f19` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*` - **f5 · big-ip_carrier-grade_nat** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-b655dc8d5b821afddbd8d93fa9489ee15a0d676811bd45d3730fe3b26cdd735d` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*` - **f5 · big-ip_container_ingress_services** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-5baa90dcb54b8e683bcfbe334e0b18cbe8ea2d032eb45cd55f7afcfa9da03368` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*` - **f5 · big-ip_ddos_hybrid_defender** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-f87c7b9b64c86afcc0c48220bda1bc92543beefff7155621fe458a2627cfe653` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*` - **f5 · big-ip_domain_name_system** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-8f453bafc34e9c461b1290b73550569e7558e64398eede2e74d46d6cb72adae8` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*` - **f5 · big-ip_fraud_protection_services** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-ec18136a1fd9c7ae5d975d2a2f5c0037e57c749e49c0715b9b8a25d6f0ee853d` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*` - **f5 · big-ip_global_traffic_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-618e73be1c78cebd98c0451389a4bfe0fed7033b9a99c5dfef4ab081a1711fd0` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_link_controller** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-8754268b8c2cde0fe6aca92689e07534654bf0c32f504fdc7eabdc3dd51c0dab` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*` - **f5 · big-ip_local_traffic_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-dfc8c075c3b90f711dd6c07c1d70e2c3507742bbcffef3651f2737a4133eeb81` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_policy_enforcement_manager** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-b94ca11deae6f3dbdfe71c801d37911c9fd185c5bd3c37c804c67d15918d47d3` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*` - **f5 · big-ip_ssl_orchestrator** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-1f7d291882e58db33699a4631d94b94ac47c4054e89f4ab9ba55e10df6020b64` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*` - **f5 · big-ip_webaccelerator** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-9a98c46bb3d6ba9611bd32eab93edabd599af91bf31121c045dc220d5c65e47b` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*` - **f5 · big-ip_websafe** (vulnerable_target; supported) - Versions: Any version (unconstrained) (>= 13.1.0, <= 13.1.5); Any version (unconstrained) (>= 14.1.0, <= 14.1.5); Any version (unconstrained) (>= 15.1.0, <= 15.1.10); Any version (unconstrained) (>= 16.1.0, <= 16.1.4); Any version (unconstrained) (>= 17.1.0, <= 17.1.1) - Canonical identity: `product-59c1a99b28f4b9b4655fbcd860d02e1150ce2f13239c2e93385600c2666878ba` - Official link states: linked_exact - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*` - Criterion (linked_exact, vulnerable_target): `cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*` ## Identity source boundaries - **cpe_dictionary**: 1775266 records through 2026-07-21T06:45:29.809553+00:00 - Run: `27d65b0f-b718-4b4f-bb79-c47c68d09dfa` - **cpe_match**: 643502 records through 2026-07-21T08:13:17.697275+00:00 - Run: `955dae73-7302-438b-aee1-058d7cc5d48e` ## Limitations and unknowns - KEV membership is authoritative for the catalog, not proof of exposure in any environment. - EPSS is a dated model probability and not an individual-environment prediction. - Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown. - NVD-carried upstream facts remain derivative and are not independent corroboration. - Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only. - NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only. - Factor D remains unknown because WC-03 has not converted canonical CPE mappings into generation-bound mapping obligations; canonical identity alone does not score applicability. - Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred. Generated from CASCA normalized evidence. This receipt is not proof that an asset is affected, unaffected, safe, or fixed.