F5 · BIG-IP and BIG-IQ Centralized Management
CVE-2021-22986
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
What it is
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CISA: F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
More exploited flaws from F5
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 22, 2026 | Heap-based Buffer Overflow | BIG-IP APM | Critical 9.3 | 25% |
| Mar 27, 2026 | Stack-Based Buffer Overflow | BIG-IP | Critical 9.3 | 2.3% |
| Oct 31, 2023 | Authentication Bypass | BIG-IP Configuration Utility | Critical 9.8 | 97% |
| Oct 31, 2023 | SQL Injection | BIG-IP Configuration Utility | High 8.8 | 4.2% |
| May 10, 2022 | Missing Authentication | BIG-IP | Critical 9.8 | >99.9% |
| Jan 18, 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Critical 9.8 | 62% |
| Nov 3, 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.