TMM vulnerability
Priority MEDIUM 44CWE-705Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed BIG-IP (F5): 17.5.1.3, 17.1.3, 16.1.6.1 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| F5 | BIG-IP | 17.5.0 to before 17.5.1.3; 17.1.0 to before 17.1.3; 16.1.0 to before 16.1.6.1; 15.1.0 to before 15.1.10.8 | 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8 | Patch available | CNA |
- BIG-IP VendorF5 Affected 17.5.0 to before 17.5.1.3; 17.1.0 to before 17.1.3; 16.1.0 to before 16.1.6.1; 15.1.0 to before 15.1.10.8 Fixed in 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8 Patch available CNA
CPE configurations NVD · 63
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
Show 53 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* | 15.1.0 to before 15.1.10.8 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* | 16.1.0 to before 16.1.6.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* | 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 | Vulnerable | F5 |
- cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* Versions 15.1.0 to before 15.1.10.8 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* Versions 16.1.0 to before 16.1.6.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* Versions 17.1.0 to before 17.1.3; 17.5.0 – 17.5.1 Vulnerable ·F5
Remediation
- Fix · CNA BIG-IP (F5) Fixed in 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
F5 BIG-IP 15.1.10.8, 16.1.6.1 and 2 more versions
13 records Highest priority Priority CRITICAL 1 CRITICAL, 7 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2025-33465 BigIP APM VulnerabilityPriority CRITICAL 99
- TI-2025-38317 TMM vulnerabilityPriority MEDIUM 44
- TI-2025-38308 BIG-IP SSL/TLS vulnerabilityPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53856
- 2026-10-03 Alias added: GHSA-m5hq-gxg5-5f9x
References
More F5 Big-ip Access Policy Manager vulnerabilities
- TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
- TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-53856 · CVE Program
- CVE-2025-53856 · NVD
- FIRST EPSS
- GHSA-m5hq-gxg5-5f9x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences