{"id":"CVE-2021-22991","kind":"vulnerability","aliases":["CVE-2021-22991"],"related":[],"title":"F5 BIG-IP Traffic Management Microkernel: F5 BIG-IP Traffic Management Microkernel Buffer Overflow","description":"On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.","summary":"F5 BIG-IP's Traffic Management Microkernel has a buffer overflow that lets a remote attacker bypass URL-based access controls. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.61064,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"F5 BIG-IP Traffic Management Microkernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["big-ip","exploited","f5","infrastructure","load-balancer","waf"],"not_affected_if":["no-big-ip-deployment"],"how_to_check":null,"fix":"Apply the F5 BIG-IP update per the vendor advisory (the sources do not name the fixed version).","status":"open","published_at":"2021-03-31T18:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:29:05+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:29:05Z","model":"claude-haiku-5-5","output":{"fix":"Apply the F5 BIG-IP update per the vendor advisory (the sources do not name the fixed version).","reach":"network","impact":"medium","summary":"F5 BIG-IP's Traffic Management Microkernel has a buffer overflow that lets a remote attacker bypass URL-based access controls. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["f5","big-ip","load-balancer","waf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker bypasses URL access controls on BIG-IP; code execution unconfirmed.","analyst_note":"Find the F5 advisory for CVE-2021-22991 to confirm affected and fixed versions, the exposed configuration, and whether code execution is possible; the KEV entry is actively exploited, so verify exposure urgently.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-big-ip-deployment"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000477,"input_tokens":2867,"output_tokens":380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':18A,21A '-22991':19A,22A '12.1':94C '12.1.5.3':97C '13.1':89C '13.1.3.6':92C '14.1':85C '14.1.4':88C '15.1':81C '15.1.2.1':84C '16.0':77C '16.0.1.1':80C 'access':61B,138C 'activ':67B 'allow':133C 'attack':56B,126C 'balanc':38B 'base':60B,137C 'big':3A,10A,25A,31B,42B,74C 'big-ip':2A,9A,24A,30B,41B,73C 'buffer':15A,50B,120C 'bypass':57B,134C 'certain':128C 'cisa':63B 'code':142C 'control':62B,139C 'cve':17A,20A 'develop':154C 'dos':125C 'end':151C 'eosd':155C 'evalu':158C 'execut':143C 'exploit':33B,68B 'f5':1A,8A,23A,34B,40B 'handl':107C 'incorrect':106C 'infrastructur':35B 'ip':4A,11A,26A,32B,43B,75C 'let':53B 'list':64B 'load':37B 'load-balanc':36B 'manag':6A,13A,46B,111C 'management':28A 'may':104C,117C,131C 'microkernel':7A,14A,29A,47B,112C 'normal':115C 'note':145C 'overflow':16A,51B,121C 'rce':144C 'reach':150C 'remot':55B,141C 'request':99C 'result':122C 'server':103C 'situat':129C 'softwar':146C,153C 'theoret':132C 'tmm':113C 'traffic':5A,12A,27A,45B,110C 'trigger':118C 'undisclos':98C 'uri':114C 'url':59B,136C 'url-bas':58B 'version':76C,147C 'virtual':102C 'waf':39B 'wild':71B 'x':78C,82C,86C,90C,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-31T18:15:14+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22991","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22991","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2021-22991","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22991","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22991","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22991","severity":null,"published_at":"2021-03-31T18:15:14+00:00","modified_at":"2026-06-17T03:38:10+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}