CVE-2021-22986: F5 BIG-IP iControl REST unauthenticated remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with CVSS 9.8, KEV listing with known ransomware use, and near-maximum EPSS probability make this an urgent patch-or-isolate case.

What it is

The iControl REST interface on multiple F5 BIG-IP and BIG-IQ versions exposes an unauthenticated remote command execution flaw, tracked as CWE-918 server-side request forgery. Because the interface is reachable without credentials and the flaw yields full command execution, it is a severe risk to any internet-exposed management plane. The record does not detail the internal mechanism beyond the SSRF classification.

Impact

An unauthenticated attacker can execute arbitrary commands on the affected device, gaining full control of the appliance and its traffic-handling and management functions. This can lead to configuration theft, traffic interception, and use of the device as a foothold into the internal network.

Attack surface

Reached over the network via the iControl REST interface (CVSS vector AV:N/PR:N/UI:N), so no authentication and no user interaction are required. Any deployment exposing the management interface to untrusted networks is directly reachable.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with a 2021-11-17 due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99898 (99.9th percentile), and multiple references carry the Exploit tag, indicating public exploit code exists.

What to do

• Apply the F5 vendor updates listed in advisory K03009991 for BIG-IP and BIG-IQ; upgrade to a fixed release for your branch.
• Restrict access to the iControl REST interface so it is not reachable from untrusted networks; place management access behind a management VLAN, VPN, or allowlisted jump hosts.
• Disable or block external exposure of the management interface and self-IPs where the REST service listens.
• Monitor F5 security advisories for updated guidance and re-check any end-of-software-development versions that were not evaluated.
• If immediate patching is not possible, apply network-level controls and increase monitoring of the management interface as a compensating measure.

Detection

• Hunt for unexpected or anomalous requests to the iControl REST endpoints on BIG-IP/BIG-IQ management interfaces, especially from external or non-management source IPs.
• Review appliance and web/proxy logs for command execution artifacts or unusual child processes spawned by the REST service.
• Alert on new or modified administrative accounts, tokens, or configuration changes on BIG-IP/BIG-IQ devices.
• Correlate management-interface access with threat intelligence for known exploitation of CVE-2021-22986.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.