CVE Alert: CVE-2025-60016 – F5 – BIG-IP

Risk verdict

High risk to availability from a remote, unauthenticated exploit that can crash the Traffic Management Microkernel (TMM); no active exploitation is indicated in the data, but impact is severe if triggered.

Why this matters

If an attacker can trigger the crash via TLS handshakes using Brainpool ECC curves in an SSL profile, a virtual server may terminate and cause service disruption. The loss of TLS termination stability can impact multiple downstream services and degrade availability for external and internal users.

Most likely attack path

• Precondition: a BIG-IP SSL profile uses Diffie-Hellman group ECC Brainpool curves and the profile is attached to a virtual server.
• Vector: remote network traffic exploiting the TLS handshake parameter, with no authentication or user interaction required.
• Outcome: TMM termination/crash leading to targeted or wider service outage on affected virtual servers; scope remains within the affected device/service.

Who is most exposed

Organisation-wide deployments of BIG-IP acting as internet-facing TLS terminators or central load balancers are most at risk, especially where Brainpool curves are configured in SSL profiles for public-facing virtual servers.

Detection ideas

• TMM crash events or core dumps logged under Traffic Management Microkernel processes.
• Spike in TLS handshake failures or cryptographic errors on affected virtual servers.
• Unusual spikes in CPU/memory utilisation of the TMM or rapid restarts of the affected VIPs.
• Unexpected termination messages in system/application logs indicating TMM termination.
• Correlated disruption of services behind the vulnerable virtual server.

Mitigation and prioritisation

• Apply vendor-released updates to non-affected builds (e.g., upgrade to later BIG-IP versions or NEXT releases indicated as safe by the advisory).
• Disable or remove Brainpool ECC curves from SSL profiles used on Internet-facing virtual servers until patched.
• Limit exposure: shield vulnerable virtual servers behind stricter ACLs or WAF rules; segment SSL termination away from high-risk endpoints.
• Test changes in a staging environment; implement a controlled rollout with rollback plan.
• Verify patch applicability and perform post-update validation of TLS configurations.