How do you patch or mitigate CVE-2022-1388 (F5 BIG-IP Missing Authentication)?

CISA’s required action for CVE-2022-1388 is to apply updates per vendor instructions. In practice, find every instance of F5 BIG-IP in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What this CVE means operationally

CVE-2022-1388 is an internet-facing appliance problem first, so the practical question is whether any F5 BIG-IP instance is reachable in a way that still leaves it exposed. For that reason, the safest interpretation of the vendor and CISA guidance is simple: inventory every deployment, apply the vendor update or mitigation, and do not leave a vulnerable system publicly reachable while you are deciding what to do.

Because this flaw was actively exploited, treat the issue as both a patching task and an exposure-reduction task. If an appliance cannot be fixed quickly, it should not remain in a position where unauthenticated traffic can reach the affected surface. The operational choice is usually between immediate remediation, temporary isolation, or removal from service until the fix is in place.

Edge Device Security Guide

How to confirm exposure and close the gap

Start by locating all F5 BIG-IP assets, then confirm which ones are internet-facing, which ones are management-accessible, and which ones are used as critical ingress or reverse-proxy points. The reason for that order matters: if you miss even one perimeter appliance, you can believe the fleet is remediated while the attack path remains open.

Once exposure is confirmed, apply the vendor security update or the documented mitigation exactly as directed by the vendor. If patching is delayed, reduce exposure immediately by removing public access, restricting reachability to trusted administrative networks, or taking the device out of service until it can be remediated safely. The objective is to eliminate the reachable vulnerable condition, not just to schedule a future fix.

Vulnerability Management Guide

What to check after remediation

After the device is patched or isolated, review logs for signs of earlier exploitation and look for indicators that the appliance was used as an entry point before remediation. In practice, that means checking for suspicious requests, unexpected administrative activity, new accounts or changes, outbound connections that do not match normal appliance behavior, and any evidence that the system was used to pivot deeper into the environment.

When a perimeter appliance flaw is exploited in the wild, the remediation task does not end with successful patch installation. You also need to decide whether the device retained any trust relationships, cached credentials, sessions, or privileged access paths that could have been abused before the fix was applied. If those paths exist, they may need to be reviewed or rotated as part of the response.

ShadowRay 2024

Risk and Threat Considerations

An exposed BIG-IP flaw is dangerous because the appliance often sits at a high-trust boundary and sees traffic that normal servers never see. If attackers can reach it before remediation, they may use it to gain foothold, pivot into internal services, or harvest configuration and operational data that helps them expand access.

Failure mechanism: The vulnerable management or application surface remains reachable long enough for unauthenticated exploitation, which can turn a perimeter device into an initial access point or a pivot toward more valuable internal systems.

Impact: Attackers may obtain pre-authenticated access, stage follow-on activity, or use the appliance’s trust position to accelerate lateral movement and persistence.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE remediation requires finding and fixing exposed BIG-IP systems quickly.
Recommendation — Prioritize and remediate exposed BIG-IP assets using a tracked vulnerability program.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE calls for discovering affected assets and verifying remediation.
	SI-2 — Flaw Remediation	The required action is vendor-directed update or mitigation of the flaw.
Recommendation — Scan for BIG-IP exposure and verify remediation status across the estate. Apply the vendor fix or mitigation and remove the vulnerable condition promptly.
ISO/IEC 27001:2022	A.8.8 — Management of Technical Vulnerabilities	Patch and mitigation handling for an exploited appliance flaw maps directly here.
Recommendation — Track the vulnerability, apply the vendor update, and document any exception.
OWASP ASVS	V13 — Configuration	Temporary mitigation may require reducing exposure and hardening the deployed configuration.
Recommendation — Restrict exposure and validate the deployment configuration until patching is complete.

Practitioner Guidance

What to prioritise: Treat every internet-facing BIG-IP instance as a time-sensitive remediation item, and prioritize the systems that front critical applications or hold the broadest network trust. If you have to choose, shrinking exposure comes before waiting for a perfect maintenance window.

What to verify: Confirm that the vendor update or mitigation actually removed the reachable attack path, not just that a change ticket was closed. Then verify logs for earlier exploitation before you declare the system clean.

Practitioner takeaway: With this class of flaw, patching and exposure control are inseparable, because a delayed fix on a perimeter appliance can still leave the environment compromised even after the update is applied.