CVE-2025-53856
TMM vulnerability
Reported by f5 · Published October 15, 2025
When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| big-ip_application_security_manager | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_fraud_protection_service | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_policy_enforcement_manager | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_websafe | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_automation_toolchain | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| BIG-IP | F5 | 17.5.1.3, 17.1.3, 17.1.2.2, 16.1.6.1, 16.1.6, 15.1.10.8 |
| big-ip_container_ingress_services | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_ddos_hybrid_defender | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_advanced_web_application_firewall | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_global_traffic_manager | f5 | 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_analytics | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
| big-ip_domain_name_system | f5 | 17.5.1, 17.1.3, 16.1.6.1, 15.1.10.8 |
10 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| F5 | BIG-IP | 17.5.0, 17.1.0, 16.1.0 |
| F5 | BIG-IP | 17.5.0, 17.1.0, 15.1.0 |
Timeline
- Oct 15, 2025 Coalition ESS Score (4 in total, the first dated here)
- Oct 15, 2025 CVE Published
- Oct 15, 2025 PoC Published (3 in total, the first dated here)
- Oct 16, 2025 EPSS Score (30 in total, the first dated here)
- Feb 26, 2026 CVE Updated
- Mar 17, 2026 Security Advisory (4 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-53856
vulnetix vdb fixes CVE-2025-53856Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-53856/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart