CVE-2025-61960: BIG-IP APM portal access vulnerability
Published Oct 15, 2025
·Updated
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
Affected Software
6 affected componentsFixes available
F5 BIG-IP APM>=17.5.0<=17.5.1, >=17.1.0<=17.1.2
17.5.1.317.1.3
F5 BIG-IP APM>=16.1.0<=16.1.6
16.1.6.1
F5 BIG-IP APM
F5 BIG-IP Access Policy Manager>=16.1.0<16.1.6.1
F5 BIG-IP Access Policy Manager>=17.1.0<17.1.3
F5 BIG-IP Access Policy Manager>=17.5.0<17.5.1.3
Event History
Oct 15, 2025
Advisory Published
via F5·10:19 AM
Data Sourced
via F5·10:19 AM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·01:55 PM
Data Sourced
via MITRE·01:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-61960?
CVE-2025-61960 is classified as a critical severity vulnerability affecting BIG-IP APM.
2
How do I fix CVE-2025-61960?
To fix CVE-2025-61960, upgrade to a patched version of the BIG-IP APM software as specified in the vendor's advisory.
3
What versions of BIG-IP APM are affected by CVE-2025-61960?
CVE-2025-61960 affects F5 BIG-IP APM versions 17.0.x, 17.1.0 to 17.1.2, and 17.5.0 to 17.5.1, as well as some versions of 16.1.x.
4
What impact does CVE-2025-61960 have on my system?
CVE-2025-61960 may cause the Traffic Management Microkernel (TMM) to terminate when a per-request policy is configured.
5
Is there a workaround for CVE-2025-61960?
Currently, there are no documented workarounds for CVE-2025-61960; the recommended action is to upgrade to a fixed version.