Introduction
When remote access services go down, business operations can stop and thousands of users can be locked out at once. F5 BIG-IP Access Policy Manager (APM) is a core part of secure application delivery and authentication for enterprises and service providers worldwide. On October 15, 2025, F5 disclosed CVE-2025-61960, a high-severity vulnerability that lets remote, unauthenticated attackers crash the core traffic engine behind BIG-IP APM portal access and deny service to all users.
F5 Networks is a global leader in application delivery and security, and its BIG-IP products run in critical infrastructure, Fortune 500 enterprises, and telecommunications providers. Organizations widely use the Access Policy Manager (APM) module for secure remote access, VPN, and web portal authentication. A vulnerability in this component therefore hits hard for any organization that depends on continuous availability and secure access control.
Technical information
CVE-2025-61960 is a NULL pointer dereference vulnerability (CWE-476) in the BIG-IP APM portal access logic. The flaw triggers when a per-request policy is configured on a portal access virtual server and the system receives certain undisclosed traffic patterns. The Traffic Management Microkernel (TMM), which handles all data-plane traffic, then terminates and restarts. Every active connection drops at once, and all services handled by the affected BIG-IP instance go down temporarily.
The vulnerability is remotely exploitable and requires no authentication or user interaction. An attacker needs only network access to the vulnerable virtual server. F5 has not publicly disclosed the specific traffic that triggers the NULL pointer dereference, which is common practice for denial-of-service issues because it slows rapid weaponization. Only the data plane is affected. The control plane and management interface are not exposed.
Root cause analysis points to insufficient validation or error handling in the per-request policy processing path for portal access. When the code processes certain malformed or unexpected traffic, it attempts to dereference a NULL pointer, and the TMM process crashes. This fits the CWE-476 classification and matches similar past issues in complex traffic management software.
As of the advisory date, neither F5 nor independent researchers have published code snippets or further technical details.
Affected systems and versions
CVE-2025-61960 affects the following F5 BIG-IP APM versions when a per-request policy is configured on a portal access virtual server:
- 17.5.0 through 17.5.1
- 17.1.0 through 17.1.2
- 16.1.0 through 16.1.5 (possibly 16.1.6, confirm with vendor advisory)
- 15.1.0 through 15.1.10
F5 did not evaluate End of Technical Support (EoTS) versions, and they may also be vulnerable. Only configurations with per-request policies on portal access virtual servers are affected.
Vendor security history
BIG-IP products have had multiple critical vulnerabilities, including remote code execution (CVE-2020-5902, CVE-2023-46747) and denial-of-service issues affecting the Traffic Management Microkernel and APM modules. In August 2025, F5 disclosed a nation-state breach in which attackers stole BIG-IP source code and vulnerability data. The breach has increased scrutiny of F5's security practices and patch response. F5 generally provides timely advisories and patches across supported versions, but recurring denial-of-service and authentication bypass issues have affected customer trust and operational risk.
