CVE-2021-22986
KEV RANSOMWAREHIGH 10.0EPSS 99.9%
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 99.90% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03, used in ransomware campaigns
- Nuclei
- critical · CWE-918
- Published
- 2021-03-31
- Updated
- 2025-10-21
Proof-of-concept exploits (17)
- http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remot…
- http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html
- Al1ex/CVE-2021-2298691★ · 2021-04-03
- AnonymouID/POC2★ · 2022-04-25
- DDestinys/CVE-2021-229860★ · 2022-04-01
- S1xHcL/f5_rce_poc26★ · 2021-03-27
- Tas9er/CVE-2021-2298613★ · 2021-03-29
- amitlttwo/CVE-2021-229860★ · 2023-02-07
- dorkerdevil/CVE-2021-22986-Poc51★ · 2021-03-17
- dotslashed/CVE-2021-229860★ · 2021-03-29
- huydung26/CVE-2021-229860★ · 2023-12-28
- kiri-48/CVE-2021-229860★ · 2021-03-22
- microvorld/CVE-2021-229860★ · 2021-03-21
- safesword/F5_RCE4★ · 2021-03-21
- saucer-man/exploit11★ · 2021-07-09
- west9b/F5-BIG-IP-POC10★ · 2022-07-30
- yaunsky/CVE-202122986-EXP8★ · 2021-03-26
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (1)
Exploit collections (4)
- chaitin/xray/blob/master/pocs/f5-cve-2021-22986.yml
- helloexp/0day/blob/master/99-%E5%AE%89%E5%85%A8%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/F5/F5…
- tzwlhack/Vulnerability/blob/main/BIG-IP-%20BIG-IQ%20iControl%20REST%20%E6%9C%AA%E7%BB%8F%…
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2021/CVE-2021-22986.yaml