ACTIVELY EXPLOITED
CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
| Vendor | F5 |
|---|---|
| Product | BIG-IP and BIG-IQ Centralized Management |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 17 Nov 2021 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-863 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
SOURCES
Other F5 flaws
- CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
- CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability
- CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
- CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.