Loading story…
F5 disclosed a critical flaw in the BIG-IP iControl REST interface, tracked as CVE-2022-1388, that allows attackers to bypass authentication and achieve unauthenticated remote code execution on exposed administrative interfaces. The issue affects the interaction between Apache and the iControl REST service, where crafted requests abusing headers such as X-F5-Auth-Token and Connection can reach privileged command-execution functionality without valid credentials. The vulnerability carries a CVSS 9.8 rating and impacts multiple BIG-IP versions, prompting F5 to publish patches and mitigation guidance.
Technical analysis showed the bug stems from request-handling logic that lets specially formed traffic evade normal authentication checks and invoke sensitive endpoints. Security reporting also indicated the flaw was being actively exploited in the wild, with thousands of potentially vulnerable internet-exposed BIG-IP systems observed, increasing the risk to organizations using the platform for application delivery and security services. Defenders were urged to patch affected devices quickly or apply F5’s recommended mitigations to restrict exposure of the management interface.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting cited Palo Alto's observation that attackers were actively exploiting CVE-2022-1388 in the wild against internet-exposed BIG-IP administrative interfaces. The same reporting noted that more than 2,500 potentially vulnerable BIG-IP instances were visible via Censys.
Technical analysis explained that the flaw stems from how BIG-IP's Apache front end and iControl REST backend process the X-F5-Auth-Token and Connection headers. By causing the proxy to strip the token after an initial presence check, an attacker can bypass authentication and reach a command-execution endpoint.
F5 published advisory K23605346 for CVE-2022-1388, a critical authentication bypass in the BIG-IP iControl REST interface that can lead to unauthenticated remote code execution. The advisory lists patched versions including 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, and 13.1.5, and provides mitigation guidance for customers that cannot upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 BIG-IP Access Policy Manager (APM) contains an actively exploited critical buffer-overflow vulnerability, **CVE-2026-94127** (CVSS 9.8), that enables unauthenticated remote code execution. An attacker can send specially crafted traffic to a vulnerable virtual server configured with both an APM access policy and an OAuth profile; the flaw affects the data plane, including Appliance Mode deployments, but not the control plane. Affected releases include BIG-IP APM 21.1.0, 17.5.x, and 17.1.x versions lacking the applicable engineering hotfixes. F5 and national cyber agencies urge administrators to install the vendor hotfixes immediately; an F5 iRule is available as a temporary mitigation. Defenders should investigate repeated OAuth failures, suspicious commands, and TMM `SIGABRT` crashes using F5’s compromise guidance, while treating any single indicator as insufficient evidence of compromise.
Sep 22, 2026
CISA added **`CVE-2025-53521`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a flaw in **F5 BIG-IP Access Policy Manager (APM)**. The vulnerability affects BIG-IP **17.x, 16.x, and 15.x** when an APM access policy is configured on a virtual server, and specially crafted unauthenticated traffic can crash and restart the **TMM** process, creating a path to potential **root-level remote code execution**. F5 had initially treated the issue as a denial-of-service bug, but reclassified it as **RCE** after new information emerged, sharply raising the severity of the threat. F5 said fixes were released in February 2025, with patched versions including **17.1.0.4**, **16.1.4.3**, and **15.1.10.2** or later, and warned that end-of-technical-support systems should be considered unprotected. CISA ordered Federal Civilian Executive Branch agencies covered by **BOD 22-01** to remediate by **March 30, 2026**, while urging organizations to assess internet-exposed F5 devices, review F5-published indicators of compromise and attacker tradecraft, and investigate for signs of intrusion. Reporting also noted the KEV listing comes after F5's earlier nation-state compromise, which allegedly exposed source code and undisclosed vulnerability information.
Jun 29, 2026
F5 has disclosed multiple vulnerabilities affecting **NGINX** product lines, including **NGINX Open Source**, **NGINX Plus**, **NGINX Gateway Fabric**, and **NGINX Ingress Controller**, with the most serious issue tracked as **`CVE-2026-42533`**. The flaw can lead to **remote code execution**, while additional reported weaknesses include **information disclosure** and **security restriction bypass** across several version ranges. National cybersecurity authorities in Europe have highlighted the breadth of affected products and the severity of the exposure. F5 released fixes on **2026-07-15** and urged customers to update immediately, warning that the vulnerable configuration is considered typical even if not every deployment is affected. Authorities also noted that **proof-of-concept exploit code** is already public, raising the likelihood of opportunistic attacks despite no confirmed large-scale exploitation so far. Where immediate patching is not possible, temporary mitigations are available, but vendor-recommended upgrades to fixed versions remain the primary remediation step.
Jul 30, 2026