CVE Vulnerabilities

CVE-2025-61960

NULL Pointer Dereference

Published: Oct 15, 2025 | Modified: Oct 21, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness

The product dereferences a pointer that it expects to be valid but is NULL.

Affected Software

Name Vendor Start Version End Version
Big-ip_access_policy_manager F5 16.1.0 (including) 16.1.6.1 (excluding)
Big-ip_access_policy_manager F5 17.1.0 (including) 17.1.3 (excluding)
Big-ip_access_policy_manager F5 17.5.0 (including) 17.5.1.3 (excluding)

Potential Mitigations

References