CVE-2025-47148
BIG-IP APM and SSL Orchestrator vulnerability
At a glance Severity HIGH 7.1 EPSS EPSS 0.39 % · percentile 33 (2026-10-27) State PUBLISHED Published 2025-10-15 Updated 2026-02-26 Assigner f5 NVD status Analyzed Description When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H f5 CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L f5 CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · f5sirt@f5.com (Secondary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H NVD · f5sirt@f5.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.10.8cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.6.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 < 17.1.3cpe:2.3:a:f5:big-ip_access_policy_manager:17.5.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.10.8cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.6.1cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 17.1.0 < 17.1.3cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0:*:*:*:*:*:*:*Affected products Product Versions F5 · BIG-IP affected 17.5.0 < 17.5.1 ; affected 17.1.0 < 17.1.3 ; affected 16.1.0 < 16.1.6.1 ; affected 15.1.0 < 15.1.10.8
References
Sources
