CVE-2022-26415

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-264177.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, wh CVE-2022-264197.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific proje CVE-2022-26427.5Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and CVE-2022-264208.8An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially CVE-2022-264217.3Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to CVE-2022-264237.5Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user crede CVE-2022-264257.3Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI CVE-2022-264266.7In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with CVE-2022-264276.7In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with CVE-2022-264286.4In video codec, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System CVE-2022-264297.8In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local esca CVE-2022-26439.8A vulnerability has been found in SourceCodester Online Admission System and classified as critical. This vulnerability affects unknown code