How to Fix CVE-2021-22991: Remote Code Execution in BIG-IP

⚠️ CISA KEV listing: active exploitation. Added to the Known Exploited Vulnerabilities catalog on 2022-01-18; remediation due date for federal civilian agencies: 2022-02-01.

What is CVE-2021-22991?

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).

The practical risk is straightforward. A successful exploit lets the attacker run arbitrary commands or code with the same privileges as the BIG-IP service. From there, the attacker can pivot to other hosts, exfiltrate data, deploy ransomware, or persist using legitimate admin tooling.

CISA has confirmed in-the-wild exploitation. The KEV catalog listing is the strongest possible signal that this is not a theoretical bug. Patch on the published timeline.

Am I affected?

You are affected if you run BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3.

On BIG-IP / BIG-IQ, run from TMOS shell:

tmsh show sys version

Or check via the management UI: System → Configuration → Device → General. Compare to the fixed version in F5's K-article linked under References.

If the build is older than the patched release listed under Fixed in, this CVE applies and you should follow the remediation steps below.

How to fix CVE-2021-22991

The vendor fix is to upgrade to a patched build. The verified patched version per the official advisory is 16.0.1.1 or later (vendor patched build).

1. Read the official advisory for the exact patched build that applies to your deployment model (see https://support.f5.com/csp/article/K56715231).

1. Plan the upgrade window. BIG-IP updates are not always hot-pluggable; check the vendor's release notes for required restarts, database migrations, or licensing steps before scheduling production downtime.

1. Take a verified backup of configuration and data before upgrading. Roll-back is faster than rebuilding.

1. Apply the patch or upgrade using your normal package or vendor installer flow. Use the vendor's documented procedure, not a third-party guide.

1. Restart services as the advisory directs. Some fixes only become active after a service restart, others after a full reboot.

Upgrade big-ip / f5 to the patched release

# Confirm the running version
tmsh show sys version

# Download the patched image from the F5 advisory: https://support.f5.com/csp/article/K56715231
tmsh save sys ucs /var/local/ucs/pre-patch.ucs
tmsh install sys software image BIGIP-<patched-version>.iso volume HD1.2
tmsh modify sys software volume HD1.2 active
reboot

# Post-reboot
tmsh show sys version

Verify the fix landed

# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://support.f5.com/csp/article/K56715231
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2021-22991 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch immediately

Apply only mitigations documented by the vendor. If no official workaround is published, the patched build is the only supported remediation. While you plan the upgrade window:

• Restrict network reach. Put BIG-IP behind a VPN, an allow-listed reverse proxy, or a firewall rule limiting source IPs to the addresses that legitimately need access. This shrinks the attack surface without changing the application.
• Disable internet exposure of the management interface if your firewall allows it. Most exploit chains for this class of bug require reachability to a specific HTTP endpoint or service port. Remove that reachability and the bug is unreachable for the moment.
• Increase logging and alerting on the affected service. Even if the workaround does not block the exploit, fast detection of an attempt is a meaningful control.

Given that this CVE is in CISA KEV, the time-to-patch window for federal civilian agencies has been set, and most enterprises track those due dates as the practical floor, not a federal-only target.

How to verify the fix worked

1. Confirm the running version of BIG-IP matches or exceeds the patched build the vendor specifies. The CVE record under References lists the fixed version explicitly.

1. Check service logs for restart messages and verify the service came up clean after the upgrade. A failed restart that silently rolls back to the unpatched binary is a common operational mistake.

1. Review the audit log for any suspicious access during the period the system was unpatched. Pre-patch exploitation leaves traces; failed login bursts, unexpected file uploads, and new admin accounts are common indicators. If the host was reachable from the internet during the exposure window, assume the IoC hunt is mandatory rather than optional.

1. Re-run a vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS) against the host after patching. The scanner should no longer flag this CVE on the same target. If it still does, double-check that you upgraded the right component, since many products bundle several services and only one of them may carry the fix.

1. Document the patch evidence for KEV reporting. Vulnerabilities in CISA KEV are tracked by FCEB agencies under BOD 22-01. Even outside the federal sector, the same evidence (build number, patch date, scanner clean report) is what auditors typically ask for.

Frequently asked questions

Related fixes

Other vulnerabilities in the same area that are worth patching alongside this one:

• How to Fix CVE-2021-1906: Security Vulnerability in Qualcomm, Inc. Snapdragon Auto — Security Vulnerability in Qualcomm, Inc. Snapdragon Auto
• How to Fix CVE-2021-28664: Privilege Escalation in Mali Graphics Processing Unit (GPU) — Privilege Escalation in Mali Graphics Processing Unit (GPU)
• How to Fix CVE-2021-33045: Authentication Bypass in Some Dahua IP Camera, Video Intercom, NVR, XVR devices , Authentication Bypass in Some Dahua IP Camera, Video Intercom, NVR, XVR devices
• How to Fix CVE-2021-39144: Code Injection in X-stream xstream , Code Injection in X-stream xstream
• How to Fix CVE-2021-44077: Remote Code Execution in ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus , Remote Code Execution in ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus

Is CVE-2021-22991 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-18, which means there is confirmed evidence of active exploitation.

Does the patch require a reboot?

It depends on the deployment. BIG-IP updates that replace running services usually need at minimum a service restart; some require a host reboot. Check the vendor release notes linked under References for the exact post-upgrade steps.

What if my version of BIG-IP is end-of-life?

End-of-life builds will not receive the fix. The vendor's published guidance in cases like this is to upgrade to a supported branch first, then apply the patched build. Running an EOL release on an internet-reachable interface is the higher risk.

References

• Official vendor advisory: https://support.f5.com/csp/article/K56715231
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-22991
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

*This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV listing on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production. Byline: Sai Kiran Pandrala.*