Live › vulnerability › CVE-2022-1388
Go to dashboardF5 BIG-IP has a missing authentication flaw in a critical function that lets an unauthenticated remote attacker run code, create or delete files, or disable services. It is listed in CISA's known-exploited catalog and attacks have been observed, with ransomware use tagged.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| F5 BIG-IP | vendor | – | – |
Unknown from the sources.
Apply the update per F5's vendor instructions; specific fixed versions are not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
This page as .md · .json · in your agent: get_signal("CVE-2022-1388")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.