CVE-2021-22986

What it actually does

This vulnerability is an unauthenticated remote command execution flaw in the F5 BIG-IP and BIG-IQ iControl REST management interface. A network-accessible attacker can abuse the REST authentication and request-handling path to reach privileged management endpoints without valid credentials, then invoke administrative utility endpoints such as command execution wrappers. Successful exploitation allows commands to run on the affected appliance with high privileges, enabling full compromise of device configuration, secrets, traffic-management policy, and potentially traffic passing through the appliance. The CVSS 9.8 score, EPSS near 1.0, CISA KEV listing, known exploitation in the wild, and ransomware association indicate this is a high-confidence, high-urgency exposure.

Why it matters to the business

A compromised BIG-IP or BIG-IQ management appliance can give attackers control over a critical traffic-routing, load-balancing, VPN, or centralized management component. Business consequences include outage of externally facing services, theft of credentials and session material, manipulation of application traffic, deployment of persistence, lateral movement into internal networks, and ransomware staging. Because this issue is in the CISA Known Exploited Vulnerabilities catalog, has a past federal remediation deadline of 2021-11-17, and has been exploited in ransomware campaigns, any remaining exposure should be treated as an active incident risk rather than a routine patch item.

How an attack unfolds

An attacker first identifies an exposed F5 management interface reachable over the network, commonly by scanning for BIG-IP or BIG-IQ management services and REST endpoints. They then send crafted unauthenticated HTTP requests to the iControl REST authentication and management API paths to bypass normal access control. Once the bypass succeeds, the attacker calls REST utility endpoints that execute administrative commands on the appliance, often to run shell commands, inspect configuration, create users, retrieve secrets, download tooling, or establish persistence. Follow-on activity may include writing files to temporary directories, modifying system or TMOS configuration, exfiltrating device credentials, pivoting through trusted network paths, or using the appliance as a launch point for ransomware operations.

How to fix it

Upgrade affected F5 software to fixed versions or later: BIG-IP 16.0.x to 16.0.1.1 or later, BIG-IP 15.1.x to 15.1.2.1 or later, BIG-IP 14.1.x to 14.1.4 or later, BIG-IP 13.1.x to 13.1.3.6 or later, BIG-IP 12.1.x to 12.1.5.3 or later, BIG-IQ 7.1.0.x to 7.1.0.3 or later, and BIG-IQ 7.0.0.x to 7.0.0.2 or later. If immediate upgrade is not possible, restrict management access to trusted administrative networks only, block public access to iControl REST and TMUI, enforce management-plane firewall rules, disable unnecessary REST exposure, and place management interfaces behind VPN or bastion controls. Rotate appliance credentials, API tokens, local admin passwords, and any secrets stored on the appliance after patching if exploitation cannot be ruled out. The supplied package metadata referencing libvnc/libvncserver appears inconsistent with this CVE’s F5 BIG-IP/BIG-IQ vulnerability; validate asset remediation against the F5 advisory rather than unrelated package fixed versions.

How to confirm the fix worked

Confirm the running BIG-IP or BIG-IQ version is at or above the fixed release for its branch. Verify that iControl REST and TMUI management interfaces are not reachable from untrusted networks or the public internet. Test from an unauthorized network location that requests to /mgmt/shared/authn/login and /mgmt/tm/util/* are blocked or require valid authentication. Review device configuration to ensure management-plane ACLs, self-IP port lockdown, and firewall rules restrict administrative access. After upgrade, confirm vendor hotfix or software build numbers match the fixed versions and that no unsupported End of Software Development branch remains in production.

Typical attack path

1. Discover an internet- or network-exposed F5 BIG-IP or BIG-IQ management interface.
2. Fingerprint the device and test whether vulnerable iControl REST endpoints are reachable.
3. Send crafted unauthenticated requests to the iControl REST authentication path to obtain or simulate privileged access.
4. Invoke management utility endpoints such as bash, tmsh, or related REST utility calls to execute commands.
5. Run discovery commands to collect hostname, user, network, and configuration information.
6. Retrieve credentials, tokens, certificates, configuration files, or traffic-management secrets from the appliance.
7. Deploy persistence, create or modify administrative accounts, stage malware, or pivot to internal systems.
8. Cover tracks by deleting temporary files or attempting to remove command/audit traces.

How to detect it

Review F5 appliance logs and upstream HTTP/WAF/proxy logs for unauthenticated requests to iControl REST endpoints, especially /mgmt/shared/authn/login followed by /mgmt/tm/util/bash, /mgmt/tm/util/tmsh, or other /mgmt/tm/util/ calls. Key local log sources include /var/log/restjavad*, /var/log/restnoded/restnoded.log, /var/log/audit, /var/log/ltm, shell history files, cron directories, and filesystem metadata in /tmp and /var/tmp. Look for suspicious REST requests containing unusual Connection headers referencing X-F5-Auth-Token, unexpected Authorization headers, command strings in utilCmdArgs, newly created admin users, tmsh changes outside change windows, outbound curl/wget activity, archive creation, or file writes by management services. Correlate with network telemetry for scanning of management ports, repeated 401/200 sequences on REST paths, and outbound connections from the appliance to unfamiliar IPs. Because exploitation has been widespread and old, examine historical logs where available and assume lack of logs does not prove lack of compromise.

• /mgmt/shared/authn/login
• /mgmt/tm/util/bash
• /mgmt/tm/util/tmsh
• /mgmt/tm/util/unix-ls
• /mgmt/tm/util/unix-mv
• /mgmt/tm/util/unix-rm
• X-F5-Auth-Token
• Connection: keep-alive, X-F5-Auth-Token
• Authorization: Basic YWRtaW46
• utilCmdArgs
• "command":"run"
• /var/log/restjavad.0.log
• /var/log/restjavad-audit.0.log
• /var/log/restnoded/restnoded.log
• /var/log/audit
• /var/log/ltm
• /tmp/
• /var/tmp/
• curl http
• wget http
• /etc/cron.d/
• /var/spool/cron/
• tmsh create auth user
• tmsh modify auth user
• bash -c

What your security team should do

• Immediately inventory all F5 BIG-IP and BIG-IQ appliances, including standby units, lab devices, disaster recovery appliances, and centralized management systems.
• Prioritize patching or isolation of any management interface reachable from the internet or broad internal networks.
• Treat any unpatched exposed appliance as potentially compromised and perform incident response review before returning it to normal service.
• Search historical logs for iControl REST authentication bypass attempts and command execution endpoint usage, especially around /mgmt/shared/authn/login and /mgmt/tm/util/bash.
• Rotate administrative passwords, API tokens, device trust credentials, and certificates if suspicious activity is found or logs are incomplete.
• Block public access to management ports and require VPN, bastion, MFA-backed administrative access, and source-IP allowlisting.
• Review appliance configuration for unauthorized users, modified startup scripts, unexpected cron entries, altered iRules, suspicious files in temporary paths, and unknown outbound connections.
• Because this vulnerability is KEV-listed and ransomware-associated, escalate unresolved exposure to emergency change management and executive risk tracking.