Task-specific Atlas Agents investigate threats at machine speed with full transparency, expert validation, and explainable outcomes you can trust.
Atlas Extended Detection and ResponseOpen XDR with Agentic AI & machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Atlas User ExperienceSee what our SOC sees, review investigations, and see how we are protecting your business.
Atlas Platform IntegrationsSeamless integrations and threat investigation that adapts to your tools and evolves with your business.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
Threat Response Unit (TRU)Proactive threat intelligence, original threat research and a world-class team of seasoned industry veterans.
Cyber Resilience TeamExtend your team capabilities and prevent business disruption with expertise from eSentire.
Response and RemediationWe balance automated blocks with rapid human-led investigations to manage threats.
Combine AI-driven security operations, multi-signal attack surface coverage and 24/7 Elite Threat Hunters to help you take your security program to the next level.
Get unlimited Incident Response with threat suppression guarantee - anytime, anywhere.
CTEM and advisory programs that identify security gaps and build proactive strategies to address them.
Flexible MDR pricing and packages that fit your unique security requirements.
Entry level foundational MDR coverage
Comprehensive Next Level eSentire MDR
Next Level eSentire MDR with Cyber Risk Advisors to continuously advance your security program
Stop ransomware before it spreads.
Identity ResponseStop identity-based cyberattacks.
Zero Day AttacksDetect and respond to zero-day exploits.
Cybersecurity ComplianceMeet regulatory compliance mandates.
Third-Party RiskDefend third-party and supply chain risk.
Cloud MisconfigurationEnd misconfigurations and policy violations.
Cyber RiskAdopt a risk-based security approach.
Mid-Market SecurityMid-market security essentials to prioritize.
Sensitive Data SecurityProtect your most sensitive data.
Cyber InsuranceMeet insurability requirements with MDR.
Cyber Threat IntelligenceOperationalize cyber threat intelligence.
Security LeadershipBuild a proven security program.
THE THREAT This advisory has been updated on December 05, 2025. TRU has observed ongoing exploitation of this critical vulnerability. Please see updated recommendations and…
THE THREATOn November 24th, 2025, a second wave of the Shai Hulud npm supply chain attack was uncovered. This wave involved the compromise of 492 npm packages collectively downloaded more…
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
About Us Leadership CareersWe provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Search our site
Multi-Signal MDR with 300+ technology integrations to support your existing investments.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
We offer three flexible MDR pricing packages that can be customized to your unique needs.
The latest security advisories, blogs, reports, industry publications and webinars published by TRU.
Compare eSentire to other Managed Detection and Response vendors to see how we stack up against the competition.
See why 2000+ organizations globally have chosen eSentire for their MDR Solution.
THE THREAT
On March 10th, 2021, F5 announced multiple critical vulnerabilities impacting their BIG-IP and BIG-IQ products. In total, seven vulnerabilities were disclosed, four of which allow Remote Code Execution if exploited. These high-impact vulnerabilities are likely to be targeted by threat actors in the near future.
To date, there is no indication that these vulnerabilities have been involved in real world attacks. Due to the prevalence of BIG-IP and BIG-IQ products, along with the criticality of the vulnerabilities, it is likely that exploitation will occur in the near future. Organizations are strongly recommended to apply the related security patches as soon as possible.
What we’re doing about it
What you should do about it
Additional information
In total, F5 released security patches for seven separate vulnerabilities. Four are classified as critical, while two are ranked as high, and the final vulnerability is medium. See the following list for vulnerability details.
CVE-2021-22987 [CVSS: 9.9]: RCE vulnerability impacting BIG-IP systems (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO). Exploitation requires authentication.
CVE-2021-22986 [CVSS: 9.8]: An unauthenticated remote code execution vulnerability. Exploitation would allow a remote unauthenticated attack to execute system commands, create/delete files, and disable services. This vulnerability impacts BIG-IP systems (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO) and the BIG-IQ Centralized Management system.
CVE-2021-22991 [CVSS: 9.0]: A buffer overflow vulnerability that may result in Denial of Service (DoS) or RCE. The vulnerability impacts BIG-IP systems (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO). In an attack scenario, threat actors could exploit this vulnerability by sending requests to a virtual server. Authentication is not required.
CVE-2021-22992 [CVSS: 9.0]: A buffer overflow vulnerability that may result in DoS or RCE. Systems vulnerable include the GIG-IP Advanced Web Application Firewall (WAF) and the BIG-IP Application Security Manager. In order to exploit this vulnerability, a threat actor would require previous access.
CVE-2021-22988 [CVSS: 8.8] An authenticated RCE vulnerability. The vulnerability impacts BIG-IP systems (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO). An already authenticated attacker with network access to the Configuration utility may exploit this vulnerability to cause code execution, create or delete files, and disable services.
CVE-21021-22989 [CVSS: 8.0] An authenticated remote command execution vulnerability. The vulnerability affects BIG-IP systems (Advanced WAF and ASM). In order to exploit this vulnerability, the attacker would need to have already compromised a highly privilege user account.
CVE-21021-22990 [CVSS: 6.6] An authenticated RCE vulnerability. The vulnerability impacts BIG-IP systems (Advanced WAF and ASM). In order to exploit this vulnerability, the attacker would need to have already compromised a highly privilege user account.
References: