CVE-2025-59481 - F5 Big-ip Ssl Orchestrator, F5 Big-ip Local Traffic Manager and F5 Big-ip Domain Name System

Critical 8.7

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected software

F5 Big-ip Ssl Orchestrator

F5 Big-ip Local Traffic Manager

F5 Big-ip Domain Name System

F5 Big-ip Application Visibility And Reporting

F5 Big-ip Link Controller

F5 Big-ip Ddos Hybrid Defender

F5 Big-ip Application Security Manager

F5 Big-ip Webaccelerator

F5 Big-ip Application Acceleration Manager

F5 Big-ip Automation Toolchain

F5 Big-ip Websafe

F5 Big-ip Analytics

F5 Big-ip Container Ingress Services

F5 Big-ip Edge Gateway

F5 Big-ip Advanced Firewall Manager

F5 Big-ip Access Policy Manager

F5 Big-ip Policy Enforcement Manager

F5 Big-ip Fraud Protection Service

F5 Big-ip Carrier-grade Nat

F5 Big-ip Advanced Web Application Firewall

F5 Big-ip Global Traffic Manager

Reference links

Get alerted to vulnerabilities in your software

CVE alerts, vulnerability alerts, latest versions and news matched to your software stack.