CVE-2017-6137: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on specific platforms and configurations.

Affected products

F5 BIG-IP Access Policy Manager: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Advanced Firewall Manager: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Analytics: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Application Acceleration Manager: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Application Security Manager: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Domain Name System: version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Global Traffic Manager: version 11.6.1 only
F5 BIG-IP Link Controller: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Local Traffic Manager: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Policy Enforcement Manager: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only
F5 BIG-IP Websafe: version 11.6.1 only; version 12.0.0 only; version 12.1.0 only; version 12.1.1 only; version 12.1.2 only

Published 2017-05-09. Last modified 2026-06-17.