F5 BIG-IP CVE-2025-53856

Exploitation requires the device to have a virtual server, NAT object, or SNAT object configured to use the embedded Packet Velocity Acceleration (ePVA) feature, AND the BIG-IP must be running on a hardware platform that physically contains an ePVA chip (enumerated in F5 article K12837). Devices without ePVA hardware, or configurations not using ePVA, are not exploitable. Software versions past End of Technical Support were not evaluated. Where these conditions are met, no authentication or user interaction is needed (PR:N/UI:N) and the attacker only needs network reachability to the affected virtual server; the hardware/feature prerequisite is the primary limiting factor reducing the exposed population below what AV:N/PR:N alone implies.

This is a denial-of-service vulnerability, not an information-disclosure or code-execution flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, and the impact metrics confirm availability-only damage (VC:N/VI:N/VA:H) - crafted traffic terminates the Traffic Management Microkernel (TMM), the core data-plane process. The 8.7 score is driven entirely by the high availability impact combined with trivial reachability. However, the real-world risk is substantially gated: exploitation requires the affected virtual server, NAT, or SNAT object to use the embedded Packet Velocity Acceleration (ePVA) feature AND the device must be running on a BIG-IP platform that physically has an ePVA chip (per F5 article K12837). Supporting signals temper the raw CVSS: EPSS is low at 0.35% (26th percentile), the CVE is NOT on CISA KEV, and no public exploit was provided - so there is no public exploit identified at time of analysis. The signals are internally consistent (network DoS with low EPSS and no observed exploitation suggests this is a patch-in-normal-cycle issue, not an emergency), with the important caveat that the vulnerable-condition prerequisites (ePVA in use on ePVA-capable hardware) mean the CVSS 'default' reachability overstates exposure for the installed base that does not use ePVA.

An attacker who can reach a BIG-IP virtual server/NAT/SNAT that is configured to use the ePVA hardware-acceleration feature sends undisclosed malformed or crafted traffic across the network. The traffic is processed down the ePVA path and causes TMM to terminate, dropping the data plane and disrupting all traffic the device is handling until it recovers. No authentication or user interaction is required, but no public proof-of-concept was provided in the input.