CVE-2025-61974: 
F5 BIG-IP Virtual Edition vulnerability analysis and mitigation

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization in F5 BIG-IP systems. The vulnerability (CVE-2025-61974) was discovered and disclosed on October 15, 2025. This vulnerability affects F5's BIG-IP products including BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes, and F5 Silverline (F5 KB).

The vulnerability has received a CVSS v4.0 Base Score of 8.7 (HIGH) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, and a CVSS v3.1 Base Score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) (NVD).

The vulnerability primarily affects system availability through increased memory resource utilization, which could potentially lead to system performance degradation or service disruption when exploited. The CVSS scores indicate high severity with potential for significant operational impact, particularly concerning system availability (NVD).

F5 has released patches as part of their October 2025 Quarterly Security Notification. Organizations are strongly urged to update their BIG-IP software as soon as possible. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also released emergency directive (ED) 26-01 with specific guidance for Federal Civilian Executive Branch agencies, though the recommendations are applicable to all organizations using F5 devices (Tenable Blog).

The vulnerability disclosure coincides with a broader security incident at F5, where a nation-state threat actor gained access to certain systems within their environment between August and October 2025. This has heightened the urgency of applying security updates across F5 products. The security community has responded with increased attention to F5 infrastructure security, particularly given the concurrent disclosure of multiple vulnerabilities (Tenable Blog).