CVE-2022-1388

CRITICAL9.8

CISA KEV

Published 2022-05-05 · Updated 2026-06-17 · Source f5sirt@f5.com

Summary

CVE-2022-1388 is a critical-severity (CVSS 9.8) vulnerability in F5 BIG-IP. CISA added it to the Known Exploited Vulnerabilities catalog on May 10, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 31, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. F5 has 8 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.

All 8 known-exploited F5 vulnerabilities →

Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-306CWE-306

CISA Known-Exploited Vulnerability

Product: F5 — BIG-IP

Name: F5 BIG-IP Missing Authentication Vulnerability

Date added: 2022-05-10 · Due: 2022-05-31

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited F5 vulnerabilities

Most recently added to CISA KEV

CVE-2026-94127
BIG-IP APM — F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
added 2026-09-22
CVE-2025-53521
BIG-IP — F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
added 2026-03-27
CVE-2023-46748
BIG-IP Configuration Utility — F5 BIG-IP Configuration Utility SQL Injection Vulnerability
added 2023-10-31
CVE-2023-46747
RANSOMWARE
BIG-IP Configuration Utility — F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
added 2023-10-31
CVE-2021-22991
BIG-IP Traffic Management Microkernel — F5 BIG-IP Traffic Management Microkernel Buffer Overflow
added 2022-01-18
CVE-2020-5902
RANSOMWARE
BIG-IP — F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
added 2021-11-03

View all →

Related CVEs

Same severity, most recent

CVE-2026-108587
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.
2026-10-15 · score 9.8
CVE-2026-110911
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
2026-10-15 · score 9.8
CVE-2026-110862
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
2026-10-14 · score 9.1
CVE-2026-55684
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
2026-10-14 · score 9.8
CVE-2026-55683
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
2026-10-14 · score 9.8