CVE-2025-61960
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Risk Assessment
TMM crash can lead to disruption of APM services, potentially affecting application availability and user authentication.
Recommendation
Apply vendor patches for supported BIG-IP versions and restrict portal access to trusted traffic only.
Other vulnerabilities in BIG-IP APM
See all- CVE-2026-94127CriticalActively exploited
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specially crafted traffic can lead to remote code execution (RCE). The vulnerability exists only when BIG-IP APM is configured as an OAuth Authorization Server; deployments using APM strictly as an OAuth Client/Resource Server are not affected.
- CVE-2026-40067High
A vulnerability in BIG-IP APM causes undisclosed traffic to terminate the apmd process when an APM access policy is configured on a virtual server.
- CVE-2025-61933Medium
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-54854High
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
Original NVD description (English source)
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS