CVE-2025-41433

BIG-IP SIP ALG profile vulnerability

When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2025-41414

BIG-IP HTTP/2 vulnerability

When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 21 more

CVE-2025-41399

SCTP Vulnerability

When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more

CVE-2025-36504

BIG-IP HTTP/2 vulnerability

When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more

CVE-2025-46405

BIG-IP APM vulnerability

When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager

CVE-2025-52585

BIG-IP Client SSL profile vulnerability

When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2025-53860

F5OS-A FIPS HSM vulnerability

A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries systems.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

F5

Products

F5os-a R10920-df R5920-df

CVE-2024-45844

BIG-IP monitors vulnerability

BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.6 High EPSS 10.6% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2025-20045

BIG-IP SIP MRF Vulnerability

When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2025-20058

BIG-IP message routing vulnerability

When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2025-21087

TMM Vulnerability

When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 20 more

CVE-2025-21091

BIG-IP SNMP vulnerability

When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2024-25560

TMM Vulnerability

When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 19 more

CVE-2024-33604

BIG-IP Configuration utility XSS vulnerability

A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2024-33608

BIG-IP IPsec vulnerability

When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more

CVE-2025-36525

BIG-IP APM PingAccess Virtual Server Vulnerability

When a BIG-IP APM virtual server is configured to use a PingAccess profile, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Access Policy Manager

CVE-2025-35995

BIG-IP PEM vulnerability

When a BIG-IP PEM system is licensed with URL categorization, and the URL categorization policy or an iRule with the urlcat command is enabled on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Big-ip Policy Enforcement Manager

CVE-2024-26026

BIG-IP Central Manager SQL Injection

An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS 7.2% KEV · Not listed

Vendors

F5

Products

Big-ip Next Central Manager

CVE-2024-21793

BIG-IP Central Manager OData Injection Vulnerability

An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed

Vendors

F5

Products

Big-ip Next Central Manager

CVE-2023-40542

BIG-IP TCP Profile vulnerability

When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

F5

Products

Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 16 more