BIG-IP APM CVE-2025-61960
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach APM portal access virtual server
-
DeliverySend crafted request to per-request policy
-
ExploitTrigger NULL pointer dereference in TMM
-
ExecutionCrash Traffic Management Microkernel
-
ImpactDenial of service on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the BIG-IP device be running the Access Policy Manager (APM) module AND that a per-request policy be configured on an APM portal access virtual server - the vulnerable code path is only reachable in that specific configuration, so devices without APM, without portal access, or without a per-request policy are not affected. Within that configuration the CVSS vector indicates remote unauthenticated exploitation with no user interaction (AV:N/PR:N/UI:N). Limiting factors: the non-default/role-specific configuration requirement substantially narrows the exposed population, and software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor, so EoTS deployments have unverified status. |
| Impact | This is a denial-of-service vulnerability in F5 BIG-IP Access Policy Manager (APM) rooted in a NULL pointer dereference (CWE-476) that terminates the Traffic Management Microkernel (TMM), the core data-plane process. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity attack requiring no privileges or user interaction, with impact confined to availability (VA:H) and no confidentiality or integrity impact - consistent with a pure DoS and with the CWE. The signals are internally consistent and point to a genuine availability risk rather than an inflated high-CVSS issue, but the real-world exposure is gated by configuration: exploitation is only possible when a per-request policy is applied to an APM portal access virtual server, a specific (non-universal) deployment mode. Exploitation-likelihood signals are modest and reinforce a measured priority: EPSS is 0.35% (26th percentile), there is no CISA KEV listing, and no public exploit code was identified. For organizations running the vulnerable APM configuration this warrants prompt patching because TMM termination can disrupt all traffic on the device, but there is no evidence of active or imminent widespread exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach a BIG-IP APM portal access virtual server that has a per-request policy configured sends crafted ('undisclosed') traffic to the virtual server. Processing this traffic triggers a NULL pointer dereference in TMM, crashing the microkernel and interrupting traffic handling on the device. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A denial-of-service condition in F5 BIG-IP Access Policy Manager (APM) allows remote, unauthenticated attackers to crash the Traffic Management Microkernel (TMM) by sending undisclosed traffic to an APM portal access virtual server that has a per-request policy configured. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), a successful trigger yields a full loss of availability on the affected data-plane process with no impact to confidentiality or integrity; exploitation requires the non-default combination of the APM module, a portal access virtual server, and a per-request policy, which substantially narrows the exposed population. No public exploit code has been identified at time of analysis, EPSS is low (0.35%, 26th percentile), and the issue has not been confirmed as actively exploited (no CISA KEV listing).
RemediationAI
No vendor-released patch with a specific fixed version is identified in the provided data at time of analysis; consult F5 advisory K000156597 (https://my.f5.com/manage/s/article/K000156597) for the exact patched BIG-IP releases and upgrade guidance, and upgrade to the listed fixed build for the relevant branch as soon as it is confirmed there - note that EoTS releases are out of scope for fixes and require an upgrade to a supported branch. Until a patch is applied, the most direct compensating control is to remove the per-request policy from the APM portal access virtual server (or to reconfigure the portal access virtual server so a per-request policy is not evaluated); the trade-off is that any access control, session, or resource-assignment logic implemented by that policy stops being enforced, so an equivalent policy must be re-implemented by other means during the interim. If the per-request policy must remain in place, restrict reachability of the affected portal access virtual server to trusted source ranges with network ACLs or a firewall/allow-list in front of the BIG-IP; this preserves policy enforcement but blocks legitimate remote users outside those ranges. Where APM portal access is not operationally required, deprovisioning or disabling the affected virtual server removes the attack surface entirely at the cost of losing that remote access service. Additionally, because TMM termination affects the data plane, ensure redundant/failover pairs are healthy and monitor TMM restart events, restart logs, and core dumps on any virtual server matching the vulnerable configuration so that attempts are detected even before a fix is deployed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a NULL pointer dereference (CWE-476) in F5's Traffic Management Microkernel (TMM), the user-space data-plane process that handles all traffic processing on BIG-IP systems. The faulty code path is reached only when the Access Policy Manager (APM) module is provisioned, the targeted virtual server is an APM portal access virtual server, and a per-request policy is attached to it; per-request policies are evaluated for each request hitting the portal rather than once per session, so malformed or unexpected traffic in that evaluation flow can dereference a null pointer and abort TMM. Because TMM sits in the traffic path, its termination causes an outage of the affected virtual server (and potentially failover behavior on redundant pairs) rather than merely a failed access-policy decision. The vendor did not evaluate software versions that have reached End of Technical Support (EoTS), so the affected-version matrix published in advisory K000156597 covers only supported releases, and the wildcard CPE strings supplied (cpe:2.3:a:f5:big-ip_access_policy_manager) do not pin specific version ranges - exact fixed and vulnerable builds must be taken from the F5 advisory. The original CVSS 4.0 score of 8.7 aligns with the independent CVSS:3.1 assessment of a high-impact, unauthenticated, availability-only remote denial of service.
Know when Big Ip Access Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable virtual server exploitable without auth or interaction (AV:N/AC:L/PR:N/UI:N); TMM crash is availability-only (A:H) with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP Access Policy Manager deployments that expose a portal access virtual server configured with a per-request policy can be knocked offline by a remote, unauthenticated denial-of-service that crashes the Traffic Management Microkernel (TMM), the process responsible for all data-plane traffic handling on the appliance. Because the triggering configuration is a non-default combination, the exposed population is limited to a subset of our BIG-IP estate, but for any appliance that meets it the impact is a complete loss of availability with no effect on confidentiality or integrity. Leadership should care because these devices typically front employee and customer authentication and application access, so an outage converts directly into visible service disruption, helpdesk volume, and possible SLA exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to APM portal access virtual servers with per-request policies to trusted source networks via firewall or ACL; remove or disable the per-request policy where it is not operationally required; decommission or migrate portal access virtual servers that do not need to be internet-facing; monitor appliance health and TMM restarts closely so an attempted trigger is detected and recovered quickly; maintain failover or standby capacity to shorten availability loss.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Big Ip Access Policy Manager
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
GitHub PoC
Exploit-DB