How to find F5 BIG-IP instances on your network

CISA issued an emergency directive (Oct 15, 2025) after a nation-state affiliated actor compromised F5 BIG-IP systems and exfiltrated proprietary source code and vulnerability information; organizations are urged to inventory BIG-IP assets, assess public exposure, apply F5 vendor updates, and disconnect affected end-of-support devices. The report also reviews the May 2022 CVE-2022-1388 (CVSS 9.8), an unauthenticated iControl REST bypass that allowed full control of vulnerable BIG-IP management interfaces, and notes that patches and mitigations are available.