CVE-2016-5021: The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x...

Security readout for executives and security teams

CVE-2016-5021 is an F5 management-plane information disclosure issue. Authenticated administrators using affected BIG-IP or BIG-IQ versions could obtain sensitive information through the iControl REST service or related management interfaces. Business urgency depends on whether these legacy systems still exist and whether management access is tightly restricted. Exposure is most likely in organizations still running BIG-IP 11.5.x, 11.6.x, early 12.x, or listed BIG-IQ 4.x/1.0 products. Systems with management interfaces reachable from broad networks have higher practical risk, but the source requires authenticated administrator access. Treat this as a legacy F5 hygiene issue with moderate urgency. Prioritize confirmation if F5 management systems remain in production, especially where administrative interfaces are broadly reachable or where admin accounts are shared, stale, or weakly controlled. Mitigation focus: Identify affected F5 BIG-IP and BIG-IQ versions in inventory.; Upgrade BIG-IP branches to the fixed versions or hotfixes named in the CVE.; Check the F5 advisory for BIG-IQ remediation guidance..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.