---
id: "CVE-2022-1388"
kind: "vulnerability"
aliases: ["CVE-2022-1388"]
title: "F5 BIG-IP: F5 BIG-IP Missing Authentication Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99954
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "F5 BIG-IP", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "f5-big-ip", "infrastructure", "ransomware", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2022-05-05T17:15:10+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-1388", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1388", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1388", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# F5 BIG-IP: F5 BIG-IP Missing Authentication Vulnerability

F5 BIG-IP has a missing authentication flaw in a critical function that lets an unauthenticated remote attacker run code, create or delete files, or disable services. It is listed in CISA's known-exploited catalog and attacks have been observed, with ransomware use tagged.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:F5 BIG-IP affected ? fixed ?

## Fix

Apply the update per F5's vendor instructions; specific fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-1388
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-1388
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-1388

## From the sources

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_