CVE-2025-59269: F5 BIG-IP APM Stored XSS Vulnerability

CVE-2025-59269 Overview

CVE-2025-59269 is a stored cross-site scripting (XSS) vulnerability affecting the F5 BIG-IP Configuration utility. An attacker with sufficient privileges can inject JavaScript that executes in the browser context of any user who subsequently loads the affected page. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and impacts the full BIG-IP module family, including Access Policy Manager (APM), Advanced Firewall Manager (AFM), Advanced Web Application Firewall (AWAF), Local Traffic Manager (LTM), Global Traffic Manager (GTM), SSL Orchestrator, and additional modules. F5 has published guidance in F5 Support Article K000151308.

Critical Impact
A successful attack allows arbitrary JavaScript execution in the context of an authenticated BIG-IP administrator, enabling session takeover and configuration tampering on network infrastructure devices.

Affected Products

F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, and Advanced Web Application Firewall
F5 BIG-IP Local Traffic Manager, Global Traffic Manager, Link Controller, and DNS
F5 BIG-IP Application Security Manager, SSL Orchestrator, Analytics, WebAccelerator, WebSafe, Policy Enforcement Manager, DDoS Hybrid Defender, Edge Gateway, CGNAT, Container Ingress Services, Application Acceleration Manager, Application Visibility and Reporting, Automation Toolchain, and Fraud Protection Service

Discovery Timeline

2025-10-15 - CVE-2025-59269 published to NVD with F5 vendor advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59269

Vulnerability Analysis

The vulnerability is a stored XSS flaw in an undisclosed page of the BIG-IP Configuration utility, the web-based management interface used to administer BIG-IP appliances. Because the payload is stored server-side, injected script executes automatically when a legitimate user renders the affected page. Exploitation runs in the browser of the currently logged-in user, inheriting that user's session, cookies, and CSRF tokens.

F5 has not published the specific page or input field involved. However, the impact vectors reported by F5 indicate high confidentiality and integrity impact on the vulnerable component, with no availability impact. The attack requires high privileges to plant the payload and requires user interaction from a victim administrator to trigger it.

Root Cause

The root cause is improper neutralization of user-supplied input before it is stored and later rendered in the Configuration utility's HTML output. When the affected page renders the persisted value without proper output encoding or a sufficient Content Security Policy, browser-side script tags or event handlers execute as trusted UI code.

Attack Vector

An authenticated attacker with sufficient privileges on the BIG-IP Configuration utility submits a crafted payload through the vulnerable input. The payload is persisted in the device configuration or backing store. When another authenticated user, typically an administrator, navigates to the affected page, the browser executes the injected JavaScript. The attacker can then exfiltrate session data, issue authenticated iControl REST calls, modify traffic policies, or pivot within the management network. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5.

No public proof-of-concept is available, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-59269

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handler attributes (onerror, onload, onmouseover) stored in BIG-IP configuration objects, object descriptions, or partition metadata.
Outbound HTTP(S) requests from administrator browsers to unfamiliar hosts immediately after loading a Configuration utility page.
Unauthorized iControl REST API calls originating from a valid administrator session token shortly after utility use.

Detection Strategies

Audit BIG-IP configuration exports (bigip.conf, bigip_gtm.conf) and stored object fields for HTML or JavaScript syntax that should not appear in name, description, or comment fields.
Correlate /var/log/audit and restjavad-audit entries for configuration write operations performed by unprivileged or unexpected accounts.
Monitor management interface HTTP traffic for responses that reflect stored fields containing script-like tokens.

Monitoring Recommendations

Forward BIG-IP audit logs, restjavad logs, and TMOS syslog to a centralized SIEM for correlation with administrator session activity.
Alert on any modification to Configuration utility objects by accounts outside the approved administrator group.
Track browser telemetry from workstations used to manage BIG-IP for anomalous script execution against the management IP.

How to Mitigate CVE-2025-59269

Immediate Actions Required

Review F5 Support Article K000151308 and apply the fixed engineering hotfix or upgrade to a supported, patched version for each affected module.
Restrict access to the BIG-IP Configuration utility to a dedicated, isolated management network and trusted jump hosts only.
Enforce least privilege on Configuration utility accounts and remove administrative rights from operators who do not require them.
Audit stored configuration fields for previously injected payloads before applying patches.

Patch Information

F5 provides fixed versions and mitigation guidance in F5 Support Article K000151308. Versions that have reached End of Technical Support are not evaluated and should be replaced with a supported release. Administrators should identify each installed BIG-IP module and confirm the running version is at or above the fixed build listed in the F5 advisory.

Workarounds

Use the Appliance Mode or role-based access controls to prevent lower-privileged users from writing to fields rendered by the affected page.
Require administrators to access the Configuration utility from a hardened browser profile that blocks third-party script execution and enforces strict cookie isolation.
Terminate all active Configuration utility sessions and rotate administrator credentials after patching if injection is suspected.

bash

# Configuration example: restrict management access via TMSH
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 192.168.100.5/32 }
tmsh modify sys sshd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config

# Verify installed version against F5 K000151308 fixed release list
tmsh show sys version