CVE-2025-61933
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, credential theft, or other actions in the user's context.
Recommendation
Update BIG-IP APM to the latest patched version and avoid using versions that have reached End of Technical Support.
Other vulnerabilities in BIG-IP APM
See all- CVE-2026-94127CriticalActively exploited
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specially crafted traffic can lead to remote code execution (RCE). The vulnerability exists only when BIG-IP APM is configured as an OAuth Authorization Server; deployments using APM strictly as an OAuth Client/Resource Server are not affected.
- CVE-2026-40067High
A vulnerability in BIG-IP APM causes undisclosed traffic to terminate the apmd process when an APM access policy is configured on a virtual server.
- CVE-2025-61960High
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-54854High
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS