CVE-2021-22991
Published 2021-03-31 · Updated 2026-06-17 · Source f5sirt@f5.com
Summary
CVE-2021-22991 is a critical-severity (CVSS 9.8) vulnerability in F5 BIG-IP Traffic Management Microkernel. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 1, 2022. CISA does not currently list it as used in ransomware campaigns. F5 has 8 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.
All 8 known-exploited F5 vulnerabilities →Description
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: F5 — BIG-IP Traffic Management Microkernel
Name: F5 BIG-IP Traffic Management Microkernel Buffer Overflow
Date added: 2022-01-18 · Due: 2022-02-01
Required action: Apply updates per vendor instructions.