The F5 cybersecurity company has released patches for two (2) critical vulnerabilities impacting their BIG-IP and BIG-IQ products. If these flaws were to be exploited, the threat actor could perform unauthenticated remote code execution (RCE) against vulnerable endpoints. The first vulnerability, tracked as CVE-2022-41622 (CVSS 8.8/10), is a cross-site request forgery (CSRF) flaw in the iControl SOAP component, affecting BIG-IP and BIG-IQ products. An attacker could exploit this vulnerability by socially engineering users with resource administrator role privileges or higher, tricking them into accessing malicious endpoints. If exploited, the threat actor could gain root access to the management interface of the vulnerable device, allowing for a complete system compromise. The second vulnerability, tracked as CVE-2022-41800 (CVSS 8.7/10), is an RPM spec injection flaw impacting the iControl REST appliance mode. If successfully exploited, an attacker who has already secured administrator credentials could again perform unauthenticated RCE by executing shell commands via RPM-specific files. Although severe, the likelihood that these flaws will be exploited at scale is low because the attackers would have to learn about the target network and compromise the correct administrator accounts before exploiting the vulnerabilities. There is a working proof-of-concept (PoC) exploit for CVE-2022-41622, so users should install the hotfixes as soon as possible. In addition to installing the patch, administrators should manually disable Basic Authentication for the iControl SOAP component after installing the hotfix. CTIX analysts urge any readers implementing this F5 security should upgrade their platforms immediately to prevent exploitation.