LIVE NEWSROOM · --:-- · May 25, 2026
A LIBRARY FOR SECURITY RESEARCHERS

CVE DATABASE  /  CVE-2022-1388

CVE-2022-1388

F5 BIG-IP Missing Authentication Vulnerability

CVSS 9.8 · CRITICAL ⚠ CISA KEV — ACTIVELY EXPLOITED RANSOMWARE
On the CISA KEV catalog

Confirmed exploited in the wild. Added 2022-05-10. Federal remediation due 2022-05-31.
Required action: Apply updates per vendor instructions.

Summary

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 breakdown

Base score9.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vectorNETWORK
Attack complexityLOW
Privileges requiredNONE
User interactionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH

Weakness type (CWE)

Affected products

F5 big-ip access policy managerF5 big-ip advanced firewall managerF5 big-ip analyticsF5 big-ip application acceleration managerF5 big-ip application security managerF5 big-ip domain name systemF5 big-ip fraud protection serviceF5 big-ip global traffic managerF5 big-ip link controllerF5 big-ip local traffic managerF5 big-ip policy enforcement manager
Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

Data: NIST NVD + CISA KEV. NVD last modified 2025-10-27. Always verify against the vendor advisory before acting.

Scroll to Top