Back to CVE records
Critical 9.8Known exploited (CISA KEV)Published May 5, 2022
CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed…
Updated under an hour ago ()
Does this affect you?
It affects F5 BIG-IP and 11 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 10, 2022; federal agencies had to remediate by May 31, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-306
- Known exploited
- Added to CISA KEV May 10, 2022; federal remediation due May 31, 2022; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 99.95% (percentile 100)
- Assigned by
- f5
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
F5 BIG-IP f5:big_ip (from the name) | from 17.0.0 before 17.0.x* not affected; from 16.1.x before 16.1.2.2; from 15.1.x before 15.1.5.1; from 14.1.x before 14.1.4.6; from 13.1.x before 13.1.5; from 12.1.x through 12.1.6; from 11.6.x through 11.6.5 | CNA record |
f5 big-ip_access_policy_manager f5:big-ip_access_policy_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_advanced_firewall_manager f5:big-ip_advanced_firewall_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_analytics f5:big-ip_analytics | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_application_acceleration_manager f5:big-ip_application_acceleration_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_application_security_manager f5:big-ip_application_security_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_domain_name_system f5:big-ip_domain_name_system | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_fraud_protection_service f5:big-ip_fraud_protection_service | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_global_traffic_manager f5:big-ip_global_traffic_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_link_controller f5:big-ip_link_controller | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_local_traffic_manager f5:big-ip_local_traffic_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
f5 big-ip_policy_enforcement_manager f5:big-ip_policy_enforcement_manager | from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2 | NVD |
References
- https://support.f5.com/csp/article/K23605346mitigation, vendor-advisory
- http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.htmlexploit, third-party-advisory, vdb-entry
- https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/exploit, mitigation, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1388us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.