Description
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published: 2025-10-15
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Oct 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared F5 big-ip Access Policy Manager
F5 big-ip Advanced Firewall Manager
F5 big-ip Advanced Web Application Firewall
F5 big-ip Analytics
F5 big-ip Application Acceleration Manager
F5 big-ip Application Security Manager
F5 big-ip Application Visibility And Reporting
F5 big-ip Automation Toolchain
F5 big-ip Carrier-grade Nat
F5 big-ip Container Ingress Services
F5 big-ip Ddos Hybrid Defender
F5 big-ip Domain Name System
F5 big-ip Edge Gateway
F5 big-ip Fraud Protection Service
F5 big-ip Global Traffic Manager
F5 big-ip Link Controller
F5 big-ip Local Traffic Manager
F5 big-ip Policy Enforcement Manager
F5 big-ip Ssl Orchestrator
F5 big-ip Webaccelerator
F5 big-ip Websafe
CPEs cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
Vendors & Products F5 big-ip Access Policy Manager
F5 big-ip Advanced Firewall Manager
F5 big-ip Advanced Web Application Firewall
F5 big-ip Analytics
F5 big-ip Application Acceleration Manager
F5 big-ip Application Security Manager
F5 big-ip Application Visibility And Reporting
F5 big-ip Automation Toolchain
F5 big-ip Carrier-grade Nat
F5 big-ip Container Ingress Services
F5 big-ip Ddos Hybrid Defender
F5 big-ip Domain Name System
F5 big-ip Edge Gateway
F5 big-ip Fraud Protection Service
F5 big-ip Global Traffic Manager
F5 big-ip Link Controller
F5 big-ip Local Traffic Manager
F5 big-ip Policy Enforcement Manager
F5 big-ip Ssl Orchestrator
F5 big-ip Webaccelerator
F5 big-ip Websafe

Mon, 20 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
First Time appeared F5
F5 big-ip
Vendors & Products F5
F5 big-ip

Wed, 15 Oct 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Oct 2025 14:00:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title BIG-IP Configuration utility XSS vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

F5 Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall Big-ip Analytics Big-ip Application Acceleration Manager Big-ip Application Security Manager Big-ip Application Visibility And Reporting Big-ip Automation Toolchain Big-ip Carrier-grade Nat Big-ip Container Ingress Services Big-ip Ddos Hybrid Defender Big-ip Domain Name System Big-ip Edge Gateway Big-ip Fraud Protection Service Big-ip Global Traffic Manager Big-ip Link Controller Big-ip Local Traffic Manager Big-ip Policy Enforcement Manager Big-ip Ssl Orchestrator Big-ip Webaccelerator Big-ip Websafe
cve-icon MITRE

Status: PUBLISHED

Assigner: f5

Published:

Updated: 2026-02-26T16:57:50.899Z

Reserved: 2025-10-03T23:04:03.853Z

Link: CVE-2025-59269

cve-icon Vulnrichment

Updated: 2025-10-15T15:46:54.378Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-15T14:15:53.960

Modified: 2025-10-21T19:33:38.710

Link: CVE-2025-59269

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-10-20T13:26:42Z

Weaknesses