Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2021-22986

🗓️ 31 Mar 2021 14:04:47Reported by f5Type 
cve
 cve🔗 web.nvd.nist.gov📰️ 12 Media mentions👁 1362 Views🌐 WEB

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability

Related
Detection
Affected
Refs
Paths
Social
ReporterTitlePublishedViews
Family
githubexploit
GithubExploit		Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager
7 May 202217:54
–githubexploit
githubexploit
GithubExploit		Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager
10 May 202204:10
–githubexploit
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager
23 Mar 202102:04
–githubexploit
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager
19 Mar 202118:50
–githubexploit
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager
7 Feb 202311:19
–githubexploit
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager
21 Mar 202107:40
–githubexploit
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager
22 Mar 202107:13
–githubexploit
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager
26 Mar 202103:32
–githubexploit
githubexploit
GithubExploit		Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager
7 May 202217:54
–githubexploit
githubexploit
GithubExploit		Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager
28 May 202213:30
–githubexploit
Rows per page
NVD
Vulners
Node
OR
f5big-ip_access_policy_managerRange12.1.0–12.1.5.3
f5big-ip_access_policy_managerRange13.1.0–13.1.3.6
f5big-ip_access_policy_managerRange14.1.0–14.1.4
f5big-ip_access_policy_managerRange15.1.0–15.1.2.1
f5big-ip_access_policy_managerRange16.0.0–16.0.1.1
f5big-ip_advanced_firewall_managerRange12.1.0–12.1.5.3
f5big-ip_advanced_firewall_managerRange13.1.0–13.1.3.6
f5big-ip_advanced_firewall_managerRange14.1.0–14.1.4
f5big-ip_advanced_firewall_managerRange15.1.0–15.1.2.1
f5big-ip_advanced_firewall_managerRange16.0.0–16.0.1.1
f5big-ip_advanced_web_application_firewallRange12.1.0–12.1.5.3
f5big-ip_advanced_web_application_firewallRange13.1.0–13.1.3.6
f5big-ip_advanced_web_application_firewallRange14.1.0–14.1.4
f5big-ip_advanced_web_application_firewallRange15.1.0–15.1.2.1
f5big-ip_advanced_web_application_firewallRange16.0.0–16.0.1.1
f5big-ip_analyticsRange12.1.0–12.1.5.3
f5big-ip_analyticsRange13.1.0–13.1.3.6
f5big-ip_analyticsRange14.1.0–14.1.4
f5big-ip_analyticsRange15.1.0–15.1.2.1
f5big-ip_analyticsRange16.0.0–16.0.1.1
f5big-ip_application_acceleration_managerRange12.1.0–12.1.5.3
f5big-ip_application_acceleration_managerRange13.1.0–13.1.3.6
f5big-ip_application_acceleration_managerRange14.1.0–14.1.4
f5big-ip_application_acceleration_managerRange15.1.0–15.1.2.1
f5big-ip_application_acceleration_managerRange16.0.0–16.0.1.1
f5big-ip_application_security_managerRange12.1.0–12.1.5.3
f5big-ip_application_security_managerRange13.1.0–13.1.3.6
f5big-ip_application_security_managerRange14.1.0–14.1.4
f5big-ip_application_security_managerRange15.1.0–15.1.2.1
f5big-ip_application_security_managerRange16.0.0–16.0.1.1
f5big-ip_ddos_hybrid_defenderRange12.1.0–12.1.5.3
f5big-ip_ddos_hybrid_defenderRange13.1.0–13.1.3.6
f5big-ip_ddos_hybrid_defenderRange14.1.0–14.1.4
f5big-ip_ddos_hybrid_defenderRange15.1.0–15.1.2.1
f5big-ip_ddos_hybrid_defenderRange16.0.0–16.0.1.1
f5big-ip_domain_name_systemRange12.1.0–12.1.5.3
f5big-ip_domain_name_systemRange13.1.0–13.1.3.6
f5big-ip_domain_name_systemRange14.1.0–14.1.4
f5big-ip_domain_name_systemRange15.1.0–15.1.2.1
f5big-ip_domain_name_systemRange16.0.0–16.0.1.1
f5big-ip_fraud_protection_serviceRange12.1.0–12.1.5.3
f5big-ip_fraud_protection_serviceRange13.1.0–13.1.3.6
f5big-ip_fraud_protection_serviceRange14.1.0–14.1.4
f5big-ip_fraud_protection_serviceRange15.1.0–15.1.2.1
f5big-ip_fraud_protection_serviceRange16.0.0–16.0.1.1
f5big-ip_global_traffic_managerRange12.1.0–12.1.5.3
f5big-ip_global_traffic_managerRange13.1.0–13.1.3.6
f5big-ip_global_traffic_managerRange14.1.0–14.1.4
f5big-ip_global_traffic_managerRange15.1.0–15.1.2.1
f5big-ip_global_traffic_managerRange16.0.0–16.0.1.1
f5big-ip_link_controllerRange12.1.0–12.1.5.3
f5big-ip_link_controllerRange13.1.0–13.1.3.6
f5big-ip_link_controllerRange14.1.0–14.1.4
f5big-ip_link_controllerRange15.1.0–15.1.2.1
f5big-ip_link_controllerRange16.0.0–16.0.1.1
f5big-ip_local_traffic_managerRange12.1.0–12.1.5.3
f5big-ip_local_traffic_managerRange13.1.0–13.1.3.6
f5big-ip_local_traffic_managerRange14.1.0–14.1.4
f5big-ip_local_traffic_managerRange15.1.0–15.1.2.1
f5big-ip_local_traffic_managerRange16.0.0–16.0.1.1
f5big-ip_policy_enforcement_managerRange12.1.0–12.1.5.3
f5big-ip_policy_enforcement_managerRange13.1.0–13.1.3.6
f5big-ip_policy_enforcement_managerRange14.1.0–14.1.4
f5big-ip_policy_enforcement_managerRange15.1.0–15.1.2.1
f5big-ip_policy_enforcement_managerRange16.0.0–16.0.1.1
f5big-iq_centralized_managementRange6.0.0–6.1.0
f5big-iq_centralized_managementRange7.0.0–7.0.0.2
f5big-iq_centralized_managementRange7.1.0–7.1.0.3
f5ssl_orchestratorRange12.1.0–12.1.5.3
f5ssl_orchestratorRange13.1.0–13.1.3.6
f5ssl_orchestratorRange14.1.0–14.1.4
f5ssl_orchestratorRange15.1.0–15.1.2.1
f5ssl_orchestratorRange16.0.0–16.0.1.1
[
  {
    "product": "BIG-IP; BIG-IQ",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3"
      },
      {
        "status": "affected",
        "version": "BIG-IQ 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
bigipAuthCookierequest body/mgmt/shared/authn/loginLogin request used in exploit chain to obtain an auth token for iControl REST.CWE-918
usernamerequest body/mgmt/shared/authn/loginLogin request used in exploit chain to obtain an auth token for iControl REST.CWE-918
loginReferencerequest body/mgmt/shared/authn/loginLogin request used in exploit chain to obtain an auth token for iControl REST.CWE-918
userReferencerequest body/mgmt/shared/authn/loginLogin request used in exploit chain to obtain an auth token for iControl REST.CWE-918
commandrequest body/mgmt/tm/util/bashEndpoint used to execute arbitrary shell commands on BIG-IP via iControl REST (RCE).CWE-918
utilCmdArgsrequest body/mgmt/tm/util/bashEndpoint used to execute arbitrary shell commands on BIG-IP via iControl REST (RCE).CWE-918

Straight-Practice-99

Fullintrusiontoolkitrecoveredfromanopendirectory:FortiGate/F5exploits,PwnKit,Ghostcat,MeshCentral

Tricky-World8776

CansomeonebetterexplainmehowCVE-2021-22986exploitworks?

/NCCGroupInfosec Blog discussing our observed in the wild exploitation attempts and detection logic for the F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986.6 https://t.co/0QqlbfGqHR?amp=1

Active DDoS malware payload detected: http://91.148.141.35/katanaslice/94VG.x86 (https://t.co/wXywbK9a0q?amp=1) Hosting provider: DA International Group Ltd. (AS203380) Target: F5 iControl REST remote command execution CVE-2021-22986 (https://t.co/BGTgYCx2wB?amp=1) #threatintel

Mass scanning activity detected from 199.203.101.28 () targeting F5 iControl REST endpoints vulnerable to unauthenticated remote command execution (CVE-2021-22986). Vendor advisory: https://t.co/MsZmXEtcTn?amp=1 #threatintel

FortiGuardLabs Informe de señales de amenazas: observado en la explotación salvaje de la vulnerabilidad de ejecución de comandos remotos F5 BIG-IP (CVE-2021-22986) https://t.co/4CMy7Li4Mb?amp=1 Visitanos en pagina web: https://t.co/yKvJEpJbj6?amp=1 Partner Oficial Fortinet Venezuela

CVE-2021-22986 F5 BIG-IP, BIG-IQ Centralized Management unauthenticated RCE. The... https://t.co/9O6OLeeORG?amp=1 Vulnerability Alert Subscriptions: https://t.co/hrQhy5uz4x?amp=1

Mass scanning activity detected from the following hosts targeting F5 iControl REST endpoints vulnerable to unauthenticated remote command execution (CVE-2021-22986). 107.191.63.34 () 85.106.105.52 () Vendor advisory: https://t.co/MsZmXEtcTn?amp=1 #threatintel

f5 big ip rce | CVE-2021-22986 poc https://t.co/TL2Kwtzgqe?amp=1 via /YouTube

Exploit attempt source IP: 176.31.159.27 () Vulnerabilities targeted: F5 iControl REST RCE (CVE-2021-22986) F5 BIG-IP Configuration Utility RCE (CVE-2020-5902) Payload: http://176.31.159.27/manager.sh (https://t.co/xAgHN4O3tc?amp=1)

Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:38Current
8.3High risk
Vulners AI Score8.3
CVSS 3.19.8
CVSS 210
EPSS0.99898
SSVC
CWE-918In Wild
cve-2021-22986big-ipremote command executionvulnerabilityunauthenticatedicontrol rest interfacenvd
1362