F5 BIG-IP AFM CVE-2025-59478

Exploitation requires that an AFM (Advanced Firewall Manager) denial-of-service protection profile be configured and applied to a virtual server on the BIG-IP device - this is the exact feature/configuration named in the vendor description and is not a default state, so systems without an AFM DoS profile bound to a virtual server are not exposed. Given that precondition, no authentication or user interaction is needed (PR:N/UI:N) and the attack is network-reachable at low complexity. The limiting factors are therefore the non-default AFM DoS-profile configuration and the exclusion of End of Technical Support versions, which F5 did not evaluate; impact is limited to availability (TMM termination), with no confidentiality or integrity effect.

This is a genuine availability threat but not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated attack whose only impact is availability (VA:H; VC:N/VI:N) - consistent with the description of TMM termination, i.e. a denial of service against the data plane. The vendor-assigned 8.7 score is driven entirely by the high availability impact on a network-edge device. Countervailing signals temper the urgency: EPSS is only 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit was identified, so there is no evidence of active or widespread exploitation. Critically, exploitation is gated by a non-default precondition - an AFM DoS protection profile must be configured on the targeted virtual server - which meaningfully narrows the exposed population versus what the AV:N/PR:N vector alone implies. No SSVC decision data was provided. Net: prioritize patching on BIG-IP systems that actually run AFM DoS protection profiles (loss of TMM takes down traffic processing), but treat it as a serious-but-not-exploited availability bug rather than a drop-everything scenario. The 'undisclosed requests' phrasing means the exact trigger is not published, slightly raising reverse-engineering effort for an attacker.

A remote, unauthenticated attacker sends specially crafted (undisclosed) requests to a BIG-IP virtual server that has an AFM DoS protection profile applied, causing the Traffic Management Microkernel to terminate and interrupting all traffic the device is processing. No public exploit code was identified, so an attacker would need to rediscover the trigger, but the low attack complexity (AC:L) and lack of required authentication (PR:N) make exploitation straightforward once the condition is known. Repeated triggering yields a sustained denial of service on the affected appliance.