CVE-2022-26130 - CVE House
Back to Database
Status published Medium CVE-2022-26130

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions...

Vulnerability Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-26130

Credits & Attribution

No credits recorded in the NVD database.

References

More from F5

View All →
CVE-2025-61990
TMM vulnerability
High 8.7
CVE-2025-61974
BIG-IP SSL/TLS vulnerability
High 8.7
CVE-2025-61960
BIG-IP APM portal access vulnerability
High 8.7
CVE-2025-61958
BIG-IP TMSH vulnerability
High 8.5
CVE-2025-61955
F5OS vulnerability
High 8.5

Affected Vendor

Affected Software

BIG-IP
Vulnerable Versions:
12.1.x, 11.6.x, 17.0.0, 16.1.x, 15.1.x, 14.1.x, 13.1.x

Timeline

Official Publish: May 5th, 2022
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-754

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1499 Endpoint Denial of Service
Impact
T1562 Impair Defenses
Defense Evasion
T1005 Data from Local System
Collection