Is CVE-2022-1388 (F5 BIG-IP Missing Authentication) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-1388 to its Known Exploited Vulnerabilities catalogue on 10 May 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

What this CVE means for exposed F5 BIG-IP appliances

CVE-2022-1388 is not a theoretical flaw to track for next quarter. It is a missing-authentication issue in a critical BIG-IP function, so the immediate question is whether any internet-facing F5 appliance can still be reached through the affected path. If it can, treat it as an active exposure that can be used for remote code execution or service disruption, not just a patching issue.

For internet-facing appliances, the practical test is simple: confirm whether the management and application paths are segmented, monitored, and limited to trusted sources. An edge appliance that is reachable from untrusted networks deserves the same urgency as any other externally exposed control plane, because compromise can quickly turn into file creation, file deletion, or disabled services.

When you are scoping exposure, anchor the work in the broader pattern of edge device security, because load balancers, gateways, and similar appliances fail in similar ways when management interfaces or appliance services are reachable where they should not be.

Why active exploitation changes the response

CISA placing a CVE in the Known Exploited Vulnerabilities catalogue means defenders should assume real exploitation pressure, not just a vulnerability class with a theoretical risk. For a flaw like this, the response shifts from ordinary maintenance to urgent exposure reduction, patching, and verification that the device was not already used as an initial access point.

That matters because BIG-IP often sits at a trust boundary. If an attacker reaches it, they may not need credentials at all, and they may be able to use the appliance as a launch point into internal applications, administrative interfaces, or adjacent infrastructure. In practice, that makes the priority order: confirm whether the device is exposed, apply the vendor fix or approved mitigation, and then validate whether any abuse occurred before or during remediation.

Use the official references for the authoritative record and remediation tracking, especially the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database, alongside the vendor advisory, so you do not rely on secondary summaries for operational decisions.

What to do if you cannot patch immediately

If patching is delayed, reduce reachability first. Restrict management access to trusted administrative networks, remove unnecessary internet exposure, and verify that any compensating control actually blocks the vulnerable path rather than only the obvious admin pages. For a device in this class, “we will patch soon” is not a control if the service remains reachable from uncontrolled networks.

Then look for signs of prior abuse. Review logs for suspicious requests, unexpected configuration changes, new or modified files, process anomalies, and service interruptions around the period of exposure. If the appliance was reachable before remediation, assume the possibility of follow-on compromise and check whether adjacent systems, credentials, or sessions were touched.

For vulnerable internet-facing appliances, the response pattern described in Zero-Day and Exploited Vulnerabilities Guide is the right operational model: emergency mitigation first, then compromise assessment, then post-fix hunting for evidence that the flaw was already used.

Risk and Threat Considerations

Internet-facing appliances are high-value targets because they sit at the boundary between public traffic and trusted internal resources. Missing authentication at that boundary can give an attacker a direct path to command execution or service disruption without needing a valid account first.

Failure mechanism: The attacker abuses the unauthenticated critical function to reach actions that should have required a trusted identity, then uses that foothold to execute code, alter files, or disable services before defenders notice.

Impact: The result can be outage, persistence, internal pivoting, or broader compromise of systems that trust the appliance, especially when the device also holds configuration, routing, or session-related material.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Explains urgent triage and remediation of actively exploited perimeter vulnerabilities.
Recommendation — Prioritise exposed BIG-IP remediation and validate containment before resuming normal operations.
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potentially adverse events	Applies because exposed appliance exploitation requires monitoring for abnormal activity and abuse.
Recommendation — Monitor BIG-IP network activity for signs of exploitation and unexpected service disruption.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Directly supports urgent patching and mitigation of an actively exploited appliance flaw.
	AC-4 — Information Flow Enforcement	Relevant because containment depends on restricting who can reach the vulnerable appliance functions.
	AU-6 — Audit Record Review, Analysis, and Reporting	Supports post-exposure review for evidence of abuse or pre-remediation compromise.
Recommendation — Remediate the BIG-IP flaw promptly and verify the fix or mitigation is in place. Restrict access to the affected BIG-IP paths and enforce network segmentation. Review appliance logs for suspicious requests and follow-on compromise indicators.

Practitioner Guidance

What to verify: Confirm whether any BIG-IP instance is still internet reachable, whether the vulnerable path is exposed, and whether compensating controls actually block unauthenticated access rather than only hiding the management interface.

Escalation / exception: Treat any unpatched exposed instance as a security exception that needs time-bounded ownership, not a deferred maintenance item. If patching must wait, escalate for immediate containment and post-exposure review.

What good looks like: The appliance is updated or effectively mitigated, external reachability is minimized, and you have evidence that logs, config state, and nearby systems were checked for signs of abuse during the exposure window.

Practitioner takeaway: For a KEV-listed perimeter appliance flaw, the real decision is not whether to patch eventually, but whether you can prove the device was not exposed long enough to become an entry point.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org