CVE-2025-61933: F5 BIG-IP APM XSS Vulnerability

CVE-2025-61933 Overview

CVE-2025-61933 is a reflected cross-site scripting (XSS) vulnerability in an undisclosed page of F5 BIG-IP Access Policy Manager (APM). An attacker can craft a malicious URL that executes JavaScript in the browser context of a logged-out user who clicks the link. The flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

F5 published advisory K000156596 to address the issue. Software versions that have reached End of Technical Support (EoTS) were not evaluated. The vulnerability requires user interaction and does not affect authenticated sessions directly, since the target must be logged out at the time of exploitation.

Critical Impact
Successful exploitation runs attacker-controlled JavaScript in the victim's browser, enabling phishing overlays, credential harvesting on the APM login page, and manipulation of client-side session artifacts.

Affected Products

F5 BIG-IP Access Policy Manager (APM)
Versions covered by F5 advisory K000156596
EoTS versions were not evaluated and should be considered at risk

Discovery Timeline

2025-10-15 - CVE-2025-61933 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61933

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in a specific, undisclosed page served by BIG-IP APM. Reflected XSS occurs when a web application returns unsanitized input from an HTTP request directly into the response body. The browser then parses the attacker-supplied payload as executable JavaScript.

Because the affected page is reachable in the logged-out state, no valid APM session is required. The attacker delivers a crafted URL to the victim through phishing, chat, or a malicious link on another site. When the victim's browser follows the link, the payload runs under the origin of the BIG-IP APM host.

Running script in that origin allows the attacker to read and modify page content on the APM login flow, alter form actions, and exfiltrate any data the user enters. The impact is bounded to the victim's browser session with the APM origin.

Root Cause

The root cause is missing or insufficient output encoding on a user-controlled parameter that is reflected into an HTML response. The application does not neutralize HTML control characters such as <, >, and " before writing them to the page, allowing script context injection.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing to the vulnerable BIG-IP APM page with a JavaScript payload embedded in a reflected parameter. The victim must click the link while logged out for the payload to execute in the APM origin. F5 has not disclosed the exact page or parameter to reduce the risk of opportunistic exploitation.

See the F5 Support Article K000156596 for vendor-specific technical details and fixed versions.

Detection Methods for CVE-2025-61933

Indicators of Compromise

HTTP GET requests to BIG-IP APM URLs containing URL-encoded <script>, javascript:, onerror=, or onload= tokens in query parameters
Referrer headers from external domains preceding requests to the APM login or portal pages
Anomalous outbound requests from user browsers to attacker-controlled domains immediately after visiting an APM URL
Cluster of clicks on identical long URLs targeting the same APM virtual server from different users

Detection Strategies

Inspect BIG-IP access and iRule logs for reflected parameter values containing HTML or JavaScript metacharacters
Deploy Web Application Firewall (WAF) signatures for reflected XSS patterns on all APM-fronted virtual servers
Correlate email gateway URL telemetry with hostnames of internet-facing BIG-IP APM devices to identify phishing campaigns
Enable browser-side Content Security Policy (CSP) reporting to capture script-source violations on the APM origin

Monitoring Recommendations

Forward BIG-IP request logs and WAF alerts to a central SIEM for continuous review of parameter payloads
Monitor for spikes in 200-response requests carrying encoded script fragments to the APM management or portal hostname
Track user-agent and geolocation anomalies on logged-out APM endpoints, which typically see low legitimate traffic

How to Mitigate CVE-2025-61933

Immediate Actions Required

Apply the fixed BIG-IP APM software version listed in F5 advisory K000156596 on all affected devices
Retire or upgrade any APM installations running End of Technical Support versions, as these were not evaluated
Educate users and administrators about phishing links that impersonate the corporate BIG-IP APM login page
Rotate any credentials that may have been entered on APM login pages during suspected exploitation windows

Patch Information

F5 has published fixed versions and mitigation guidance in F5 Support Article K000156596. Administrators should consult the advisory for the exact fixed release train applicable to their deployment and follow F5's standard TMOS upgrade procedures.

Workarounds

Enable the BIG-IP Advanced WAF or ASM policy on the APM virtual server with reflected XSS signatures active in blocking mode
Restrict access to the APM management and portal interfaces to trusted networks using packet filters or a jump host
Configure a strict Content Security Policy header on APM-published pages to limit inline script execution
Deploy HttpOnly and Secure flags on APM session cookies to reduce the value of any client-side compromise

bash

# Example: apply a strict CSP header via an iRule on the APM virtual server
when HTTP_RESPONSE {
    HTTP::header insert "Content-Security-Policy" \
        "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'"
    HTTP::header insert "X-Content-Type-Options" "nosniff"
    HTTP::header insert "Referrer-Policy" "no-referrer"
}