Back to the CVE list
CVE-2021-22986 CISA KEV · Actively exploitedLinked to ransomware

F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

CVSS score

—

EPSS probability

%99.9

Risk score

—

Published

5 y ago

OverviewPublic Exploits (14)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
Al1ex/CVE-2021-22986
GitHub

CVE-2021-22986 & F5 BIG-IP RCE (★84)

Public PoCSource updated: 12.05.2022 11:10:48
G
dorkerdevil/CVE-2021-22986-Poc
GitHub

This is a Poc for BIGIP iControl unauth RCE (★52)

Public PoCSource updated: 09.05.2022 21:38:49
G
S1xHcL/f5_rce_poc
GitHub

cve-2021-22986 f5 rce 漏洞批量检测 poc (★29)

Public PoCSource updated: 18.01.2022 18:22:31
G
Udyz/CVE-2021-22986-SSRF2RCE
GitHub

F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE (★14)

Public PoCSource updated: 03.11.2021 22:24:11
G
Tas9er/CVE-2021-22986
GitHub

Code By:Tas9er / F5 BIG-IP 远程命令执行漏洞 (★9)

Public PoCSource updated: 16.03.2022 14:51:33
G
ZephrFish/CVE-2021-22986_Check
GitHub

CVE-2021-22986 Checker Script in Python3 (★2)

Public PoCSource updated: 21.05.2021 09:55:58
G
Osyanina/westone-CVE-2021-22986-scanner
GitHub

A vulnerability scanner that detects CVE-2021-22986 vulnerabilities. (★0)

Public PoCSource updated: 20.03.2021 16:46:00
G
microvorld/CVE-2021-22986
GitHub

F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE (★0)

Public PoCSource updated: 22.03.2021 11:46:33
G
DDestinys/CVE-2021-22986
GitHub

BIGIP F5 (★0)

Public PoCSource updated: 01.04.2022 11:03:21
G
huydung26/CVE-2021-22986
GitHub

Custom POC of CVE-2021-22986 by Al1ex@Heptagram (★0)

Public PoCSource updated: 28.12.2023 10:50:07
G
whatheheckisthis/Canonical-Extension-CVE-2021-22986
GitHub

Exploit-Class Deterministic Control Validation System (ECD-CVS) grounded in CVE-derived failure class abstraction, enforcing ASVS-mapped control evaluation with cryptographically verifiable execution traces. (★0)

Public PoCSource updated: 15.04.2026 17:58:38
G
whatheheckisthis/bigip-icontrol-rce-research
GitHub

Structured SecDevOps research platform modelling CVE-2021-22986 (F5 BIG-IP iControl REST unauthenticated RCE) (★0)

Public PoCSource updated: 11.04.2026 06:33:28
E
F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated)
Exploit-DB

F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated)

Exploit referenceSource updated: 02.04.2021 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22986.yaml
Nuclei

Nuclei: F5 iControl REST - Remote Command Execution

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-22986"