# F5 BIG-IP CVE-2022-1388 actively exploited in wild

Published: 2025-07-17 · Severity: high · Sectors: government-national, financial-services, energy, healthcare, infrastructure
Canonical: https://vorant.io/reports/87d5214a-3e45-5f50-a6d3-305e03e7dcc3/f5-big-ip-cve-2022-1388-actively-exploited-in-wild

> Critical unauthenticated F5 BIG-IP vulnerability enabling remote code execution is actively being exploited with public POC available.

CVE-2022-1388 is a critical authentication bypass in F5 BIG-IP's iControl REST interface affecting versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and end-of-life 12.1.x and 11.6.x versions. An unauthenticated attacker with network access to the management port or self-IP addresses can exploit this vulnerability to execute arbitrary system commands, create or delete files, or disable services. F5 released patches on May 4, 2022, but public proof-of-concept exploits followed, lowering the barrier to exploitation. As of May 2022, CISA confirmed active exploitation in the wild and assessed widespread compromise of unpatched devices was likely, particularly those with publicly exposed management interfaces. Defenders should assume compromise for any unpatched device with internet-facing management access and hunt for malicious activity. Immediate patching is critical; if patching is impossible, implement temporary workarounds including blocking iControl REST access via self-IP and management interface, and modify httpd configuration per F5 guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2022-1388 (KEV)

## Detection guidance (public sample)

### F5 BIG-IP iControl REST util/bash Request (CVE-2022-1388 Exploitation)

ATT&CK: T1190

Detects POST requests to the iControl REST /mgmt/tm/util/bash endpoint, the command-execution primitive abused after the CVE-2022-1388 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: F5 BIG-IP iControl REST util/bash Request (CVE-2022-1388 Exploitation)
description: Detects POST requests to the iControl REST /mgmt/tm/util/bash endpoint
  on BIG-IP management/self-IP interfaces. This endpoint runs arbitrary shell commands
  and is the primitive used after the CVE-2022-1388 authentication bypass. Generalises
  on the endpoint and method, not on specific commands, source IPs or payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /mgmt/tm/util/bash
  condition: selection
falsepositives:
- Administrators or automation intentionally running shell commands through the iControl
  REST util/bash API from a trusted management host
level: high
id: c758e69c-6aac-5e04-8334-d3a9286ea9ba
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a
```

### Suspicious Shell Spawned by Java (restjavad) on F5 BIG-IP

ATT&CK: T1059.004

Detects a bash shell spawned by a java parent (restjavad/iControl REST) running download, reverse-shell, or account-manipulation commands, as seen after CVE-2022-1388 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Shell Spawned by Java (restjavad) on F5 BIG-IP
description: Detects bash launched with -c by a java parent process (iControl REST
  service restjavad on BIG-IP) whose command line contains download, reverse shell,
  payload staging or tmsh user-creation patterns. Post-exploitation behaviour of CVE-2022-1388
  command execution, not specific to one payload.
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1548
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    Image|endswith:
    - /bash
    - /sh
    CommandLine|contains: ' -c '
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - mkfifo
    - bash -i
    - chmod +x
    - base64 -d
    - nc -e
    - create auth user
    - authorized_keys
  condition: selection_parent and selection_cmd
falsepositives:
- Java-based management or deployment agents on the host legitimately invoking curl
  or wget through a shell wrapper
- Administrators using iControl REST automation to run maintenance scripts
level: medium
id: d0d0df10-a867-5397-a05f-ead6ed8b4df0
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/87d5214a-3e45-5f50-a6d3-305e03e7dcc3/f5-big-ip-cve-2022-1388-actively-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup