Vendor

F5

Vulnerabilities in F5 BIG-IP's iControl REST and TMUI management interfaces — application-delivery controllers whose compromise typically hands attackers control of the load-balanced traffic behind them.

CVEs

CVE-2022-1388

[ CRITICAL ] CVSS 9.8 kev

F5 BIG-IP iControl REST Authentication Bypass

An authentication-bypass vulnerability in the F5 BIG-IP iControl REST API allows an unauthenticated attacker with network access to the management interface or self-IP addresses to execute arbitrary system commands, create or delete files, or disable services.

F5 / BIG-IP May 4, 2022

Articles

~/articles/2026-07-02-f5-big-ip-icontrol-rest-auth-bypass

Explainer

F5 BIG-IP's Maximum-Severity Auth Bypass: What CVE-2022-1388 Actually Exposed

A critical authentication-bypass flaw in F5 BIG-IP's iControl REST API let unauthenticated attackers execute system commands on appliances that front an enormous share of enterprise application traffic.

Jul 2 read →