F5 BIG-IP iControl REST Authentication Bypass (CVE-2022-1388) for 2026-10-19

Oct 19, 2026 Exploitation

Last Updated: 00:00 UTC

CVE-2022-1388 is an authentication bypass (CVSS 9.8) in the F5 BIG-IP iControl REST API (/mgmt/tm/) that allows unauthenticated command execution on the management plane. Mass exploitation began within days of public disclosure, deploying webshells and cryptocurrency miners.

CVE References

CVE-2022-1388

MITRE ATT&CK

Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application

Observed URIs

Attackers by Country

China: 13France: 4Sweden: 3United States: 2Germany: 2South Korea: 2Brazil: 2Canada: 2Russia: 2Indonesia: 1India: 1Czechia: 1Argentina: 1Vietnam: 1Türkiye: 1Nicaragua: 1Slovenia: 1Hong Kong: 1Suriname: 1Philippines: 1Singapore: 1Ecuador: 1The Netherlands: 1Italy: 1
China1327.7%
France48.5%
Sweden36.4%
United States24.3%
Germany24.3%
South Korea24.3%
Brazil24.3%
Canada24.3%
Russia24.3%
Indonesia12.1%
India12.1%
Czechia12.1%
Argentina12.1%
Vietnam12.1%
Türkiye12.1%
Nicaragua12.1%
Slovenia12.1%
Hong Kong12.1%
Suriname12.1%
Philippines12.1%
Singapore12.1%
Ecuador12.1%
The Netherlands12.1%
Italy12.1%

IP Address : ASN : City/Provider

Share on: