CVE-2021-22986
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
9.8
CVSS 3.1
99.9 %
EPSS (current)
2021-11-03
KEV addition
Yes
Ransomware
Timeline
Publication, first public exploit and KEV addition on a day axis.
Key facts
Vendor / product: F5 / BIG-IP and BIG-IQ Centralized Management
Published: 2021-03-31 · Due (CISA): 2021-11-17
CWE: CWE-918 · EU list: no
Exploit references (metadata only)
| Source | Reference | Title | Date |
|---|---|---|---|
| nuclei | http/cves/2021/CVE-2021-22986.yaml | F5 iControl REST - Remote Command Execution | – |
| metasploit | exploit/linux/http/f5_icontrol_rest_ssrf_rce | exploit/linux/http/f5_icontrol_rest_ssrf_rce | 2021-03-10 |
| exploitdb | 49738 | F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated) | 2021-04-02 |
References only — no downloads or instructions.