CVE-2015-8240: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.

Affected products

• F5 BIG-IP Access Policy Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Advanced Firewall Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Analytics: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Application Acceleration Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Application Security Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Global Traffic Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Link Controller: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Local Traffic Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Policy Enforcement Manager: version 11.4.1 only; version 11.5.3 only; version 11.6.0 only
• F5 BIG-IP Protocol Security Module: version 11.4.1 only

Published 2016-04-11. Last modified 2026-06-17.