F5 BIG-IP APM CVE-2025-47148
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege network access to SAML/SLO endpoint
-
ExploitSend repeated crafted single-logout requests
-
ImpactExhaust memory and deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires the BIG-IP system to be simultaneously configured as a SAML Service Provider AND Identity Provider with Single Logout (SLO) enabled on an access policy - a specific, non-default dual-role configuration. Absent this exact setup the vulnerability is not exposed, which significantly limits the affected population. Exploitation further requires low-level privileges (PR:L per the CVSS vector), so it is not fully unauthenticated; no user interaction is needed. End-of-Technical-Support software versions were not evaluated by the vendor and fall outside this assessment. |
| Impact | This is a moderate-severity denial-of-service issue (CVSS 4.0 base 7.1) in F5 BIG-IP APM/SSL Orchestrator, and the signals consistently point to a real-but-not-urgent priority rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires at least low-level privileges (PR:L), and impact is confined to availability (VA:H, SA:L) with no confidentiality or integrity effect (VC:N/VI:N) - consistent with the CWE-404 resource-handling weakness and the description's 'increase in memory resource utilization.' EPSS is low at 0.39% (31st percentile), the CVE is NOT on CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent widespread exploitation. The main mitigating factor is the narrow precondition: the system must be configured as BOTH a SAML SP and IdP with single logout (SLO) enabled on an access policy - a specific, non-default deployment that sharply limits the exploitable population. No conflicting signals were found across sources, but note that only a single F5 vendor advisory (K000148816) is referenced and affected version boundaries are not fully enumerated in the provided CPE data. |
| Exploit ScenarioDerived | An attacker with low-level access to a BIG-IP system that is dual-configured as a SAML service provider and identity provider with SLO enabled sends repeated undisclosed/crafted single-logout requests to the access policy endpoint. Each request drives up memory consumption, and sustained requests exhaust available memory, degrading or denying service to legitimate users. No public exploit code is identified at time of analysis, so an attacker would need to develop their own request pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Memory exhaustion in F5 BIG-IP Access Policy Manager (and BIG-IP SSL Orchestrator) can be induced by undisclosed requests when the system is configured simultaneously as a SAML Service Provider and Identity Provider with Single Logout (SLO) enabled on an access policy, producing a high availability impact (CVSS 4.0 base 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only systems running that specific, non-default dual-role configuration are exposed, and the vector indicates low-privileged authenticated access is required, so the affected population is narrow. Repeated requests progressively increase memory utilization rather than causing immediate failure, and there is no public exploit identified at time of analysis; EPSS is 0.39% (31st percentile), consistent with a real but lower-priority issue rather than a top-tier emergency.
RemediationAI
Consult the F5 security advisory at https://my.f5.com/manage/s/article/K000148816 for the vendor-released fixed software versions applicable to BIG-IP Access Policy Manager and BIG-IP SSL Orchestrator, and upgrade to the indicated release; this is the primary and definitive fix, and EoTS versions must be moved to a supported release to receive it. If an immediate upgrade is not possible, the most effective compensating control is to avoid the vulnerable configuration: disable Single Logout (SLO) on affected access policies or separate the SAML Service Provider and Identity Provider roles onto distinct BIG-IP instances or access policies so the dual-role code path is never exercised - the trade-off is that users lose cross-application single logout and may retain sessions until timeout. As a secondary measure, restrict network access to the SAML/logout endpoints of the BIG-IP virtual server to trusted identity sources or client ranges and monitor memory utilization for abnormal growth after logout activity, with the trade-off that legitimate remote users outside those ranges will be blocked until the patch is applied; because the CVSS vector indicates low-privileged access is needed, reducing the number of accounts able to reach the SAML endpoints also reduces the attack surface.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-404 (Improper Resource Shutdown or Release) within the SAML handling of BIG-IP Access Policy Manager, where the BIG-IP functions as both a SAML Service Provider and a SAML Identity Provider. When Single Logout - the SAML protocol flow that propagates session termination across SPs and IdPs - is enabled on an access policy, the dual-role handling of those logout requests fails to release associated resources, allowing memory to accumulate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) confirms network reachability, no attack-complexity or additional-attacker tooling requirements, low privileges (PR:L, i.e., not fully unauthenticated), no user interaction, no confidentiality or integrity impact, and a high availability impact on the vulnerable component with only a low subsequent availability impact - the signature of a resource-exhaustion denial-of-service rather than a code-execution or data-exposure bug. Because a BIG-IP is normally deployed either as a SAML SP or as a SAML IdP for a given access policy, the trigger condition requires an intentional dual-role design, which is why exposure is limited; the same processing path exists in the affected BIG-IP SSL Orchestrator builds per the supplied CPE data.
Know when Big Ip Access Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Network-reachable SLO endpoint (AV:N) with low complexity, but requires low-level authentication (PR:L); impact is availability-only memory exhaustion (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP Access Policy Manager and BIG-IP SSL Orchestrator deployments that simultaneously act as a SAML Service Provider and Identity Provider with Single Logout enabled can be driven into progressive memory exhaustion by authenticated users, degrading availability of the access gateway that fronts critical applications. Exposure is confined to organizations running this non-default dual-role configuration, and no public exploit has been identified, but for those affected, sustained memory pressure can interrupt authentication services. Leadership should prioritize inventorying exposed systems and approving interim mitigations, because no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Single Logout and/or avoid running the simultaneous SAML Service Provider and Identity Provider roles on affected virtual servers; rate-limit or throttle requests reaching the affected access policy; monitor memory utilization for the progressive growth pattern described in the advisory; and restrict low-privileged authenticated accounts capable of generating the triggering requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Big Ip Access Policy Manager
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
GitHub PoC
Exploit-DB