F5 BIG-IP iControl REST Authentication Bypass (CVE-2022-1388) for 2026-08-08
Aug 08, 2026
Exploitation
Last Updated: 00:00 UTC
CVE-2022-1388 is an authentication bypass (CVSS 9.8) in the F5 BIG-IP iControl REST API (/mgmt/tm/) that allows unauthenticated command execution on the management plane. Mass exploitation began within days of public disclosure, deploying webshells and cryptocurrency miners.
CVE References
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| Poland | 1 | 33.3% |
| Germany | 1 | 33.3% |
| Sweden | 1 | 33.3% |
IP Address : ASN : City/Provider
-
20.215.70.187 : AS8075 Microsoft Corporation : Warsaw
-
20.218.66.54 : AS8075 Microsoft Corporation : Frankfurt am Main
-
4.223.171.122 : AS8075 Microsoft Corporation : Sweden