Introduction
On October 15, 2025, F5 Networks disclosed a high-severity vulnerability in its BIG-IP Policy Enforcement Manager (PEM) product line. Under specific configuration conditions, a remote attacker can terminate the Traffic Management Microkernel (TMM) and cause a denial of service. For the service providers and enterprises that run BIG-IP as critical network infrastructure, that kind of traffic disruption can have immediate and far-reaching impact.
About F5 Networks and BIG-IP: F5 Networks is a major global vendor in application delivery and security. Its BIG-IP platform is widely deployed in telecommunications, large enterprises, and service provider networks. BIG-IP Policy Enforcement Manager is a module for advanced traffic classification and policy enforcement, often used in high-throughput, mission-critical environments.
Technical Information
CVE-2025-54479 is triggered when a classification profile is configured on a BIG-IP virtual server without an HTTP or HTTP/2 profile. In that misconfiguration, certain undisclosed network requests can make TMM perform an out-of-bounds write (CWE-787), which terminates the process. The classification engine tries to analyze application-layer traffic without the protocol parsing logic it needs, and violates a memory boundary. TMM then crashes and restarts, which disrupts all traffic the affected instance processes.
- The vulnerability is remotely exploitable without authentication.
- Only the data plane (traffic processing) is affected. The control plane is not exposed.
- F5 has not publicly disclosed the request patterns that trigger the issue.
- No code snippets or proof-of-concept details are available in public sources.
Affected Systems and Versions
- Affects F5 BIG-IP Policy Enforcement Manager (PEM)
- Also affects BIG-IP Next CNF and BIG-IP Next for Kubernetes
- Vulnerable when a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile
- Only versions under active technical support are evaluated. End of Technical Support (EoTS) versions are not covered.
- For exact fixed versions, refer to the official F5 advisory
Vendor Security History
F5 Networks has a history of critical vulnerabilities in the BIG-IP platform, including earlier TMM-related issues and remote code execution flaws. The vendor typically addresses them through quarterly security notifications and has a reputation for transparent disclosure and timely patches. Its products are operationally complex, though, so a vulnerability can have significant impact before patches are widely deployed.
