CVE-2025-53856: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 .  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

  • F5 BIG-IP Access Policy Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Advanced Firewall Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Advanced Web Application Firewall: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Analytics: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Application Acceleration Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Application Security Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Application Visibility And Reporting: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Automation Toolchain: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Carrier-Grade Nat: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Container Ingress Services: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Ddos Hybrid Defender: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Domain Name System: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Edge Gateway: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Fraud Protection Service: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Global Traffic Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3)
  • F5 BIG-IP Link Controller: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Local Traffic Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Policy Enforcement Manager: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP SSL Orchestrator: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Webaccelerator: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1
  • F5 BIG-IP Websafe: from 15.1.0, before 15.1.10.8 (fixed in 15.1.10.8); from 16.1.0, before 16.1.6.1 (fixed in 16.1.6.1); from 17.1.0, before 17.1.3 (fixed in 17.1.3); from 17.5.0, up to and including 17.5.1

Published 2025-10-15. Last modified 2026-10-08.