CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 5 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 100%
EPSS score, percentile 100 of all scored records
- How severe?
- 9.8 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline . Apply updates per vendor instructions.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- from 16.1.x to before 16.1.2.2
- from 15.1.x to before 15.1.5.1
- from 14.1.x to before 14.1.4.6
- from 13.1.x to before 13.1.5
- 12.1.x through 12.1.6
- 11.6.x through 11.6.5
Unaffected 17.0.0
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | 17.0.0 |
| Affected | from 16.1.x to before 16.1.2.2 |
| Affected | from 15.1.x to before 15.1.5.1 |
| Affected | from 14.1.x to before 14.1.4.6 |
| Affected | from 13.1.x to before 13.1.5 |
| Affected | 12.1.x through 12.1.6 |
| Affected | 11.6.x through 11.6.5 |
Versions the record lists as unaffected: 17.0.0.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2022-1388 to its Known Exploited Vulnerabilities (KEV) catalog on 10 May 2022.
- CISA marks it as known to be used in ransomware campaigns.
- The due date CISA sets for the required action is 31 May 2022.
- The CVE record was published on 5 May 2022, 5 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-306: Missing Authentication for Critical Function
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
References
More exploited F5 vulnerabilities
- CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
- CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
- CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability
- CVE-2021-22991: F5 BIG-IP Traffic Management Microkernel Buffer Overflow
- CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability