CVE-2025-61935

HighCVSS 7.5

Published: 15/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

Summary

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Risk Assessment

The attack can cause the bd process to crash, potentially disrupting WAF/ASM protection and leading to security breaches of applications.

Recommendation

Apply vendor patches for supported BIG-IP versions and monitor traffic for unexpected requests.

Other vulnerabilities in BIG-IP Advanced WAF

CVE-2025-61938High
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters for Data Guard Protection Enforcement, either manually or via Policy Builder, the bd process can terminate repeatedly. Note: EoTS versions not evaluated.

Original NVD description (English source)

When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS