CVE-2025-36525

HIGH 7.5CVE-2025-36525 · Published 07/05/2025 · updated 17/06/2026

In short

CVE-2025-36525 is a HIGH (CVSS 7.5) vulnerability affecting big-ip access policy manager (f5).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.0% of all vulnerabilities.
Fix: update to 15.1.10.7.0.4.5, 16.1.6, 17.1.2.2 or later.

Package	Affected versions	Patched versions
big-ip access policy manager f5	`≥ 15.1.0, < 15.1.10.7.0.4.5≥ 16.1.0, < 16.1.6≥ 17.1.0, < 17.1.2.2`	`15.1.10.7.0.4.516.1.617.1.2.2`

Description

When a BIG-IP APM virtual server is configured to use a PingAccess profile, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References

my.f5.com/manage/s/article/K000150598 · Vendor Advisory

More vulnerabilities in big-ip access policy manager

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

big-ip access policy manager

≥ 15.1.0, < 15.1.10.7.0.4.5≥ 16.1.0, < 16.1.6≥ 17.1.0, < 17.1.2.2

15.1.10.7.0.4.516.1.617.1.2.2

More vulnerabilities in big-ip access policy manager

See all →