CVE-2025-59268: F5 BIG-IP APM Information Disclosure Flaw

CVE-2025-59268 Overview

CVE-2025-59268 is an information disclosure vulnerability affecting F5 BIG-IP systems. The flaw exists in the Configuration utility, where undisclosed endpoints containing static, non-sensitive information are reachable by unauthenticated remote attackers. F5 assigned this issue CWE-201: Insertion of Sensitive Information Into Sent Data.

The vulnerability affects a broad range of BIG-IP modules, including Local Traffic Manager (LTM), Access Policy Manager (APM), Advanced Web Application Firewall (AWAF), Application Security Manager (ASM), Global Traffic Manager (GTM), SSL Orchestrator, and additional modules that expose the Configuration utility. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5.

Critical Impact
An unauthenticated remote attacker can retrieve static content from undisclosed BIG-IP Configuration utility endpoints, providing reconnaissance data useful for follow-on attacks.

Affected Products

F5 BIG-IP Local Traffic Manager (LTM), Access Policy Manager (APM), and Advanced Web Application Firewall (AWAF)
F5 BIG-IP Application Security Manager (ASM), Advanced Firewall Manager (AFM), and DDoS Hybrid Defender
F5 BIG-IP Global Traffic Manager (GTM), DNS, SSL Orchestrator, Policy Enforcement Manager (PEM), Link Controller, Carrier-Grade NAT, Analytics, Application Acceleration Manager, Application Visibility and Reporting, Automation Toolchain, Container Ingress Services, Edge Gateway, Fraud Protection Service, WebAccelerator, and WebSafe

Discovery Timeline

2025-10-15 - CVE-2025-59268 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59268

Vulnerability Analysis

The BIG-IP Configuration utility is the web-based management interface used to administer F5 BIG-IP appliances. According to the F5 advisory, several endpoints in this utility return static content without enforcing authentication. An unauthenticated remote attacker who can reach the management interface over the network can query these endpoints and retrieve their content.

F5 classifies the exposed data as static and non-sensitive. However, information returned from a management interface can still support attacker reconnaissance, including version fingerprinting, feature enumeration, and mapping of internal application structures. The issue is tracked under CWE-201, which covers insertion of information into sent data that a reasonable user would not intend to expose.

The vulnerability requires network access to the Configuration utility, no privileges, and no user interaction.

Root Cause

The root cause is missing authentication on specific Configuration utility endpoints. Requests to these endpoints return their static payloads directly, bypassing the standard access controls that protect the rest of the management interface.

Attack Vector

An attacker sends unauthenticated HTTPS requests to the affected endpoints on the BIG-IP management interface. Because no session, token, or credentials are required, exploitation reduces to issuing HTTP GET requests to the undisclosed URLs referenced in the F5 advisory. F5 has not published the specific endpoint paths in the public advisory. Refer to the F5 Security Advisory K90301300 for details on affected endpoints and fixed versions.

Detection Methods for CVE-2025-59268

Indicators of Compromise

Unauthenticated HTTP GET requests to BIG-IP Configuration utility endpoints originating from untrusted networks or unexpected source addresses.
Access log entries showing 200 OK responses to management interface URLs without a preceding authentication event.
Repeated enumeration-style requests against the BIG-IP management IP address, particularly from a single external source.

Detection Strategies

Review httpd and restjavad access logs on BIG-IP for unauthenticated requests to Configuration utility paths.
Correlate management interface access with authentication events to identify successful responses that lack a matching login.
Alert on any inbound connection to the BIG-IP management interface from outside an approved administrative network range.

Monitoring Recommendations

Forward BIG-IP audit and access logs to a central SIEM or data lake for correlation with network telemetry.
Track HTTP status codes and URI patterns on the management interface to baseline normal administrative activity.
Monitor perimeter and internal firewall logs for connections targeting TCP/443 or TCP/8443 on BIG-IP management addresses.

How to Mitigate CVE-2025-59268

Immediate Actions Required

Consult F5 Security Advisory K90301300 to identify fixed software versions for each affected BIG-IP module.
Upgrade BIG-IP systems to a version listed as fixed by F5, prioritizing appliances whose Configuration utility is reachable from untrusted networks.
Restrict access to the BIG-IP Configuration utility to a dedicated out-of-band management network.

Patch Information

F5 has published fixed software versions in K90301300. Software versions that have reached End of Technical Support are not evaluated and will not receive fixes; customers running EoTS versions should upgrade to a supported branch. No public proof-of-concept exploit or CISA KEV listing exists for CVE-2025-59268 at the time of writing.

Workarounds

Limit management interface exposure using the BIG-IP httpd allow list, restricting the Configuration utility to specific administrative source IP addresses.
Place the BIG-IP management interface on an isolated management VLAN not routable from the internet or general user networks.
Front the management interface with a jump host or VPN that requires authentication before any traffic reaches the Configuration utility.

bash

# Restrict BIG-IP Configuration utility access to trusted admin subnets
# (run from tmsh on the BIG-IP)
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 192.168.10.0/24 }
tmsh save sys config