CVE-2025-53856: TMM vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-15 · updated 2026-10-08
Weakness: CWE-705

Description

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 BIG-IP APM: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
BIG-IP: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Advanced Web Application Firewall: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Analytics: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Networks, Inc. BIG-IP (AAM): from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
BIG-IP ASM: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Application Visibility And Reporting: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Automation Toolchain: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Carrier-Grade Nat: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 BIG-IP Container Ingress Services: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Ddos Hybrid Defender: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 BIG-IP DNS: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Edge Gateway: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Fraud Protection Service: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Global Traffic Manager: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Link Controller: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 BIG-IP (LTM): from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Networks, Inc. BIG-IP (PEM): from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Ssl Orchestrator: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Webaccelerator: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3
F5 Big-Ip Websafe: from 15.1.0 before 15.1.10.8; from 16.1.0 before 16.1.6.1; from 17.1.0 before 17.1.3; from 17.5.0 through 17.5.1 — fixed in 15.1.10.8, 16.1.6.1, 17.1.3

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 15.1.10.8, 16.1.6.1, 17.1.3; BIG-IP 15.1.10.8, 16.1.6.1, 17.1.3; F5 Big-Ip Advanced Web Application Firewall 15.1.10.8, 16.1.6.1, 17.1.3; F5 Big-Ip Analytics 15.1.10.8, 16.1.6.1, 17.1.3; F5 Networks, Inc. BIG-IP (AAM) 15.1.10.8, 16.1.6.1, 17.1.3; BIG-IP ASM 15.1.10.8, 16.1.6.1, 17.1.3; F5 Big-Ip Application Visibility And Reporting 15.1.10.8, 16.1.6.1, 17.1.3; F5 Big-Ip Automation Toolchain 15.1.10.8, 16.1.6.1, 17.1.3; F5 Big-Ip Carrier-Grade Nat 15.1.10.8, 16.1.6.1, 17.1.3; F5 BIG-IP Container Ingress Services 15.1.10.8, 16.1.6.1, 17.1.3; F5 Big-Ip Ddos Hybrid Defender 15.1.10.8, 16.1.6.1, 17.1.3; F5 BIG-IP DNS 15.1.10.8, 16.1.6.1, 17.1.3. Check the vendor advisory for mitigations.

References

https://my.f5.com/manage/s/article/K000156707

Get alerted when CVE-2025-53856 or the next vulnerability affects your stack