Is CVE-2022-1388 actively exploited?

CVE-2022-1388 has no public evidence of in-the-wild exploitation as of 2025-10-27.

What is the CVSS score for CVE-2022-1388?

CVE-2022-1388 has a CVSS score of 9.8 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2022-1388?

Patch guidance is available from f5 security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2022-1388.

Fix CVE-2022-1388 - CRITICAL f5 big-ip access policy manager

Q: Which products are affected by CVE-2022-1388?

66 products: f5 big-ip access policy manager, f5 big-ip access policy manager, f5 big-ip access policy manager, f5 big-ip access policy manager, f5 big-ip access policy manager, and 61 more.

Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-306 · Missing Authentication CWE-306 · Missing Authentication

Metadata

Primary Vendor: F5
Published: 5/5/2022
Last Modified: 10/27/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

f5 : big-ip_access_policy_managerf5 : big-ip_access_policy_managerf5 : big-ip_access_policy_managerf5 : big-ip_access_policy_managerf5 : big-ip_access_policy_managerf5 : big-ip_access_policy_managerf5 : big-ip_advanced_firewall_managerf5 : big-ip_advanced_firewall_managerf5 : big-ip_advanced_firewall_managerf5 : big-ip_advanced_firewall_managerf5 : big-ip_advanced_firewall_managerf5 : big-ip_advanced_firewall_managerf5 : big-ip_analyticsf5 : big-ip_analyticsf5 : big-ip_analyticsf5 : big-ip_analyticsf5 : big-ip_analyticsf5 : big-ip_analyticsf5 : big-ip_application_acceleration_managerf5 : big-ip_application_acceleration_managerf5 : big-ip_application_acceleration_managerf5 : big-ip_application_acceleration_managerf5 : big-ip_application_acceleration_managerf5 : big-ip_application_acceleration_managerf5 : big-ip_application_security_managerf5 : big-ip_application_security_managerf5 : big-ip_application_security_managerf5 : big-ip_application_security_managerf5 : big-ip_application_security_managerf5 : big-ip_application_security_managerf5 : big-ip_domain_name_systemf5 : big-ip_domain_name_systemf5 : big-ip_domain_name_systemf5 : big-ip_domain_name_systemf5 : big-ip_domain_name_systemf5 : big-ip_domain_name_systemf5 : big-ip_fraud_protection_servicef5 : big-ip_fraud_protection_servicef5 : big-ip_fraud_protection_servicef5 : big-ip_fraud_protection_servicef5 : big-ip_fraud_protection_servicef5 : big-ip_fraud_protection_servicef5 : big-ip_global_traffic_managerf5 : big-ip_global_traffic_managerf5 : big-ip_global_traffic_managerf5 : big-ip_global_traffic_managerf5 : big-ip_global_traffic_managerf5 : big-ip_global_traffic_managerf5 : big-ip_link_controllerf5 : big-ip_link_controllerf5 : big-ip_link_controllerf5 : big-ip_link_controllerf5 : big-ip_link_controllerf5 : big-ip_link_controllerf5 : big-ip_local_traffic_managerf5 : big-ip_local_traffic_managerf5 : big-ip_local_traffic_managerf5 : big-ip_local_traffic_managerf5 : big-ip_local_traffic_managerf5 : big-ip_local_traffic_managerf5 : big-ip_policy_enforcement_managerf5 : big-ip_policy_enforcement_managerf5 : big-ip_policy_enforcement_managerf5 : big-ip_policy_enforcement_managerf5 : big-ip_policy_enforcement_managerf5 : big-ip_policy_enforcement_manager

Remediation Guidance

Executive Summary

View on NIST NVD