CVE-2025-59268 BIG-IP Configuration utility vulnerability

On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-59269 BIG-IP Configuration utility XSS vulnerability

A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-53474 BIG-IP iRules vulnerability

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-53474 BIG-IP iRules vulnerability

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000151297: BIG-IP TMM vulnerability CVE-2025-58424

Security Advisory Description On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection. CVE-2025-58424 Impact This vulnerability may allow a remote, unauthenticated attacker to inject malicious...

K000154647: BIG-IP tmsh vulnerability CVE-2025-61958

Security Advisory Description A vulnerability exists in the iHealth utility of the TMOS Shell tmsh that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to the Advanced Shell bash. For BIG-IP systems running in Appliance...

K000156800: BIG-IP Configuration utility vulnerability CVE-2025-59483

Security Advisory Description An arbitrary file upload vulnerability exists in an undisclosed URL in the Configuration utility. CVE-2025-59483 Impact A highly privileged authenticated attacker may be able to exploit this vulnerability to upload arbitrary files. This is a control plane issue; ther...

K000152341: BIG-IP AFM DoS protection profile vulnerability CVE-2025-59478

Security Advisory Description When a BIG-IP AFM denial-of-service DoS protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-59478 Impact Traffic is disrupted while the TMM process restarts. This...

K000150010: BIG-IP AFM security exposure

Security Advisory Description After a reboot, the BIG-IP AFM ipsd process may unexpectedly fail to enforce the Intrusion Prevention System IPS signatures configured for protocol inspection profiles. This condition can persist for some time even though the system reports the protocol inspection...

K000151368: BIG-IP SSL Orchestrator vulnerability CVE-2025-55036

Security Advisory Description When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. CVE-2025-55036 Impact System performance can degrade until the Traffic Management...

K000156691: BIG-IP TMM vulnerability CVE-2025-58096

Security Advisory Description When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-58096 Impact Traffic is disrupted while the TMM process...

K000156602: BIG-IP APM vulnerability CVE-2025-54854

Security Advisory Description When a BIG-IP APM OAuth access profile Resource Server or Resource Client is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. CVE-2025-54854 Impact Traffic is disrupted while the apmd process restarts. This vulnerability...

K000151475: BIG-IP PEM vulnerability CVE-2025-54479

Security Advisory Description When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-54479 Impact Traffic is disrupted while the TMM process restarts. This...

K000156733: BIG-IP SSL/TLS vulnerability CVE-2025-61974

Security Advisory Description When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. CVE-2025-61974 Impact System performance can degrade until the Traffic Management Microkernel TMM process is either forced to resta...

K44517780: BIG-IP iRules vulnerability CVE-2025-53474

Security Advisory Description When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-53474 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remot...

K000151902: BIG-IP SCP and SFTP vulnerability CVE-2025-53868

Security Advisory Description When running in Appliance mode, a highly privileged authenticated attacker with access to Secure Copy SCP protocol and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. CVE-2025-53868 Impact In Appliance mode, an authenticated attacke...

K000156741: BIG-IP APM vulnerability CVE-2025-53521

Security Advisory Description When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution RCE. CVE-2025-53521 Important : We have learned that this vulnerability has been exploited. If your BIG-IP APM system is running a vulnerab...

K000156621: BIG-IP Advanced WAF and ASM vulnerability CVE-2025-54858

Security Advisory Description When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. CVE-2025-54858...

K000156596: BIG-IP APM XSS vulnerability CVE-2025-61933

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. CVE-2025-61933. Impact An attacker may exploit this vulnerability by causing a use...

K000150752: BIG-IP HTTP/2 vulnerability CVE-2025-55669

Security Advisory Description When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-55669 Impact Traffic is disrupted for new client...