CVE-2025-55669

When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-55670

On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-53521

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution RCE. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-41430

When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-47148

When the BIG-IP system is configured as both a Security Assertion Markup Language SAML service provider SP and Identity Provider IdP, with single logout SLO enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have...

CVE-2025-61974 BIG-IP SSL/TLS vulnerability

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-59483 BIG-IP Configuration utility and tmsh vulnerability

A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-59483 BIG-IP Configuration utility and tmsh vulnerability

A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-54755 BIG-IP Configuration utility vulnerability

A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-54755 BIG-IP Configuration utility vulnerability

A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-61974

CVE-2025-61974 describes a memory-resource vulnerability in F5 BIG‑IP where, when a client SSL profile is configured on a virtual server, undisclosed requests can cause increased memory usage, leading to degraded performance or DoS. Affected BIG‑IP versions include 15.1.x (up to 15.1.10.8), 16.1....

CVE-2025-59483

CVE-2025-59483 is a vulnerability in the BIG-IP Configuration utility where an arbitrary file upload can be performed by an authenticated, highly privileged attacker (CWE-73: External Control of File Name or Path). The Red Hat advisory confirms a control plane issue with a vulnerability class tha...

CVE-2025-59481 BIG-IP iControl REST and tmsh vulnerability

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell tmsh command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security...

CVE-2025-61960

CVE-2025-61960 affects BIG-IP APM portal access. When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can trigger a NULL-pointer/related issue in TMM, causing the Traffic Management Microkernel (TMM) to terminate. This is a data-plane DoS risk ...

CVE-2025-61960 BIG-IP APM portal access vulnerability

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-61960 BIG-IP APM portal access vulnerability

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-61958 BIG-IP TMSH vulnerability

A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a...

CVE-2025-54854 BigIP APM Vulnerability

When a BIG-IP APM OAuth access profile Resource Server or Resource Client is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-61958

CVE-2025-61958 is an iHealth TMOS Shell (tmsh) privilege-bypass vulnerability in BIG-IP. An authenticated user with at least Resource Administrator privileges can bypass tmsh restrictions and gain Advanced Shell (bash) access, potentially crossing Appliance mode boundaries. F5 provides fixes in m...

CVE-2025-54854

CVE-2025-54854 affects BIG-IP APM when an OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, potentially causing the apmd process to terminate and DoS disruption. Public details indicate vulnerable BIG-IP APM versions include 17.x branches, with fixes int...