Critical severity9.8CISA KEVNVD Advisory· Published May 5, 2022· Updated Jun 17, 2026
CVE-2022-1388
CVE-2022-1388
Description
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
6- packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/nvdExploitMitigationThird Party Advisory
- support.f5.com/csp/article/K23605346nvdMitigationVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
2- TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted DevelopmentUnit 42 · Jul 15, 2026
- Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersectTenable Blog · May 27, 2026