CVE-2025-61990: 
F5 BIG-IP Virtual Edition vulnerability analysis and mitigation

CVE-2025-61990 is a vulnerability affecting F5's BIG-IP products when using a multi-bladed platform configuration. The vulnerability was discovered and disclosed on October 15, 2025, affecting multiple versions of BIG-IP software including versions 15.1.x, 16.1.x, and 17.1.x. The issue specifically impacts the Traffic Management Microkernel (TMM) when handling undisclosed traffic patterns in multi-blade configurations (NVD).

The vulnerability has been assigned a CVSS v4.0 base score of 8.7 HIGH (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is classified as CWE-415 (Double Free) and can cause the Traffic Management Microkernel to terminate when specific undisclosed traffic patterns are processed (NVD).

When successfully exploited, this vulnerability can cause the Traffic Management Microkernel (TMM) to terminate, potentially leading to service disruption in affected F5 BIG-IP deployments. The high severity ratings indicate significant potential impact on system availability (NVD).

F5 has released patches for affected versions as part of their October 2025 Quarterly Security Notification. Organizations are strongly advised to update their BIG-IP software to the latest patched versions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also issued emergency directive (ED) 26-01 requiring federal agencies to mitigate these vulnerabilities (Tenable Blog).