CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 1 February 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 62.42% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 18 January 2022 · due 1 February 2022
- Weakness
- CWE-119
- Affected
- f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip advanced web application firewall · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip ddos hybrid defender · f5/big-ip domain name system · f5/big-ip fraud protection service · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/ssl orchestrator
- Source
- f5sirt@f5.com
EPSS moved from 62.4% on 25 October 2026 to 62.4% on 30 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-22991
References
- https://support.f5.com/csp/article/K56715231Vendor Advisory
- https://support.f5.com/csp/article/K56715231Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22991US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.