CVE-2022-1388

Vendorf5Productbig-ip advanced firewall manager, big-ip policy enforcement manager, big-ip access policy manager, big-ip analytics, big-ip application acceleration manager, big-ip application security manager, big-ip link controller, big-ip local traffic manager, big-ip global traffic manager, big-ip domain name system, big-ip fraud protection serviceDiscoveredMay 5, 2022UpdatedOct 27, 2025

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

View graph Watch Export

CVSS v3.1

9.8 CRITICAL

EPSS

99.9%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 25, 2026

● 0.00pp

99.9% → 99.9% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Connections

13 relationships

CWE-306

source

Timeline

disclosure → media coverage

May 5, 2022

Disclosure — published as a CVE record. · last revised by NVD Oct 27, 2025

Sep 15, 2026

securityweek.com reports: Thai Broadband Provider Hacked via Fortinet Vulnerability

Public PoC (10)

github.com/numanturle/CVE-2022-1388 github.com/jheeree/CVE-2022-1388-checker github.com/MrCl0wnLab/Nuclei-Template-CVE-2022-1388-BIG-IP-iControl-REST-Exposed github.com/Osyanina/westone-CVE-2022-1388-scanner github.com/doocop/CVE-2022-1388-EXP github.com/blind-intruder/CVE-2022-1388-RCE-checker-and-POC-Exploit github.com/Hudi233/CVE-2022-1388 github.com/sherlocksecurity/CVE-2022-1388-Exploit-POC github.com/yukar1z0e/CVE-2022-1388 github.com/0xf4n9x/CVE-2022-1388

Unverified third-party code — review before executing.