Is CVE-2021-22991 (F5 BIG-IP Traffic Management Microkernel Buffer Overflow) being exploited in the wild?

Why Exploited-in-the-Wild Status Matters for CVE-2021-22991

When a vulnerability appears in CISA’s KEV catalogue, the practical question changes from “is this worth tracking?” to “is this exposed, and how fast can we contain it?” For a BIG-IP traffic management flaw that can bypass URL-based access controls, exploitation status matters because the control failure is not theoretical, it can alter who reaches protected functions.

That makes confirmation and prioritisation the first tasks. If the appliance is reachable, internet-facing, or used to front sensitive applications, treat KEV status as a live operational signal rather than a historical note. This is especially true for edge devices, where compromise can sit in the path of many downstream services at once.

Follow the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation details, and use the Edge Device Security Guide to assess whether the appliance has management exposure, weak logging, or weak patch discipline that would make exploitation harder to spot.

How to Confirm Exposure and Contain Risk on BIG-IP

The right response is to determine whether any BIG-IP instance is present, externally reachable, and responsible for traffic control paths that matter to the business. For this kind of device, “patched somewhere in the environment” is not enough if the vulnerable instance still sits in front of production applications or privileged administrative paths.

If the appliance cannot be immediately remediated, reduce exposure by restricting network reachability, tightening administrative access, and monitoring for unusual request patterns or control bypass attempts. For edge appliances, compensate with segmentation and monitoring, because the device itself is often part of the trust boundary.

Use the Zero-Day and Exploited Vulnerabilities Guide to structure emergency triage, and the Vulnerability Management Guide to turn KEV status into a prioritised remediation queue with verification and exception handling.

What to Check If You Suspect Exploitation

Because the flaw affects an appliance that can sit inline for many users and services, the main concern is not only initial compromise but also stealthy abuse of access control decisions. Review logs, configuration changes, authentication events, unexpected admin actions, and any signs that traffic was redirected or filtered in ways the business did not intend.

Where the appliance may have exposed protected resources, investigate whether attackers used the bypass to reach internal interfaces or sensitive application functions. If there is evidence of compromise, widen the review to adjacent systems that depended on the BIG-IP for access enforcement, because the impact may show up downstream rather than on the device alone.

When the device is being used as a front door for sensitive services, correlate activity with the MITRE ATT&CK Enterprise Matrix for technique-driven hunting, and use the CVE Program to anchor your internal recordkeeping to the exact weakness and its canonical identifier.

Risk and Threat Considerations

Exploited edge-device flaws are dangerous because they often sit at a chokepoint where one successful bypass can affect many downstream systems. In this case, the control failure is especially relevant because URL-based access controls are supposed to enforce policy at the boundary, so a bypass can undermine assumptions about what was protected.

Failure mechanism: The vulnerable microkernel component can be driven into a buffer overflow, and that can let an attacker defeat the expected access-control decision path on the appliance.

Impact: Successful exploitation can expose protected application paths, undermine trust in the traffic management layer, and create a foothold for broader compromise of services behind the appliance.

Practitioner Guidance

What to prioritise: Treat confirmed KEV status as a containment-and-remediation event, not a routine patch ticket. If the appliance is internet-facing or governs privileged application paths, it should move to the front of the queue.

What to verify: Confirm whether the vulnerable BIG-IP instance is actually in service, what it protects, and whether logs show anomalous access-control behaviour, configuration drift, or unexpected administrative activity.

Practitioner takeaway: For exploited edge-device vulnerabilities, the key judgement is blast radius, if the appliance sits in a trust boundary, assume the impact can extend well beyond the device itself until you have verified otherwise.

Related resources from NHI Mgmt Group

• CVE-2021-22991 (F5 BIG-IP Traffic Management Microkernel Buffer Overflow)
• How do you patch or mitigate CVE-2025-53521 (F5 BIG-IP Stack-Based Buffer Overflow)?
• Is CVE-2021-30983 (Apple iOS and iPadOS Buffer Overflow) being exploited in the wild?
• Is CVE-2022-1388 (F5 BIG-IP Missing Authentication) being exploited in the wild?