CVE Alert: CVE-2025-61990 – F5 – BIG-IP

Risk verdict

High risk of Denial-of-Service to the Traffic Management Microkernel (TMM) over the network, with no authentication required; current exploitation activity is not indicated, but impact is substantial for affected deployments.

Why this matters

TMM is central to BIG-IP traffic handling; a crash can disrupt application delivery across load balancers and trigger outages or degraded performance. Realistic attacker goals include forcing failover storms, service degradation, or disruption of multi-blade platforms where traffic can provoke TMM termination.

Most likely attack path

Remote attacker can send crafted traffic to the TMM interface to trigger a double-free condition, causing termination or crash. Exploitation requires no user interaction and no privileges, making any network-connected BIG-IP instance with affected TMM surfaces at risk; multi-blade platforms may experience broader disruption due to inter-blade traffic handling.

Who is most exposed

Organisations with on-prem or cloud-hosted BIG-IP deployments that provide network-facing TMM access, especially on legacy or EoTS-ineligible releases and multi-blade configurations, are at greatest exposure.

Detection ideas

• TMM crash or restart events logged in system logs; sudden spikes in core dumps.
• Unexpected HA failovers or traffic disruption without service changes.
• Core dumps or segmentation faults reported by the kernel; repeated termination events across blades.
• Increased crash-related forensic artifacts during high traffic periods.

Mitigation and prioritisation

• Apply the fixed/patch release aligning with your BIG-IP line; prioritise upgrades to supported versions.
• If patching immediately isn’t possible, segment TMM network paths, restrict access to trusted sources, and isolate multi-blade traffic where feasible.
• Implement robust monitoring for TMM stability, enable early alerting on crash/log events, and enforce change-control for upgrade windows.
• Verify EoTS status; decommission or isolate affected lines if maintenance windows are not available.