CVE-2021-22986: F5 BIG-IP iControl REST unauthenticated remote code execution
The short version: F5 BIG-IP's iControl REST management API has an unauthenticated flaw (CVE-2021-22986) — a server-side request forgery that an attacker can leverage into remote command execution on the appliance, with no credentials. It scores 9.8, it's in CISA's KEV catalog, and working exploits appeared within days of the March 2021 disclosure. If your management API is reachable, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.90% · 99.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2021-11-17 |
| Known exploited? | Yes — public exploitation followed disclosure within days |
| Vulnerability type | CWE-918 server-side request forgery → unauthenticated remote command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | BIG-IP: 12.1.x < 12.1.5.3, 13.1.x < 13.1.3.6, 14.1.x < 14.1.4, 15.1.x < 15.1.2.1, 16.0.x < 16.0.1.1 · BIG-IQ: 7.0.0.x < 7.0.0.2, 7.1.0.x < 7.1.0.3 |
| Fixed in | BIG-IP 12.1.5.3 · 13.1.3.6 · 14.1.4 · 15.1.2.1 · 16.0.1.1 · BIG-IQ 7.0.0.2 · 7.1.0.3 |
What you need to know
iControl REST is the BIG-IP management API. CVE-2021-22986 is a server-side request forgery in that interface that an unauthenticated attacker can drive to execute arbitrary system commands on the appliance — bypassing the authentication the API is supposed to enforce.
- How they find it — internet-wide scanning surfaces exposed BIG-IP management interfaces and the iControl REST endpoint.
- How they use it — a crafted, unauthenticated request coerces the appliance into running attacker-chosen commands; public proof-of-concept code made this point-and-click within days.
- What it leads to — full control of a device that fronts application delivery and often administrative access, with no password required.
This is pre-authentication, network-reachable, and automatable — the combination that turns a management-plane bug into a mass-exploited one.
How serious we see it
High — on paper and in the real world.
Unauthenticated command execution on the control plane of a security appliance is top-of-queue by definition, and the near-certain EPSS reflects how routinely this is exercised. The reassuring, bounded part: it affects specific BIG-IP and BIG-IQ versions, the fixes have been out since 2021, and you can tell quickly whether it applies to you. The management interface should never have been internet-facing in the first place — closing that exposure removes most of the risk regardless of patch state.
Recommendations
Straight from F5's advisory (K03009991) and CISA:
- Patch now. Upgrade BIG-IP to 12.1.5.3 / 13.1.3.6 / 14.1.4 / 15.1.2.1 / 16.0.1.1 (or BIG-IQ 7.0.0.2 / 7.1.0.3) or later.
- Get the management interface off the public internet. Restrict iControl REST and the config utility to a trusted management network — F5's standing guidance.
- Hunt for prior use. Given the exploitation timeline, review the appliance for unexpected accounts, files, and webshells before trusting it.
- If compromised, respond fully. Rebuild and rotate all credentials, keys, and certificates on the device.
- Confirm your exposure first. Verify whether any BIG-IP or BIG-IQ management interface is reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing BIG-IP interfaces from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV. Where authorized, it goes beyond detection and safely performs a bounded, rate-limited check to confirm whether the management interface actually responds to the unauthenticated request, rather than flagging a maybe.
That's the difference between "you appear to run a vulnerable BIG-IP" and "here's a confirmed, ranked exposure" — from the same outside-in view an attacker gets.