The vulnerability resides in the Traffic Management Microkernel (TMM) of F5 BIG‑IP when Advanced Firewall Manager (AFM) or Distributed Denial of Service (DDoS) services are provisioned. Undisclosed or malformed traffic can trigger a NULL pointer dereference in TMM, causing the kernel to terminate and the BIG‑IP system to become unavailable. This flaw results in a denial of service to all users and network services dependent on the affected device. The CVSS score of 8.7 indicates a high severity impact with full loss of service availability in the affected environment.

The flaw affects F5 BIG‑IP appliances that have AFM or DDoS provisioned. Specific vulnerable product variants and versions are not enumerated in the public advisory; however, the advisory notes that end‑of‑support releases are not evaluated, implying that only actively supported releases are at risk.

The EPSS score is reported to be below 1 %, suggesting that the exploitation likelihood is low, and the flaw is not listed in the CISA KEV catalog. Nonetheless, the CVSS score indicates that a successful exploitation would fully disrupt availability. An attacker would need to send specially crafted traffic towards the BIG‑IP device over the network, which could be performed remotely where the device is exposed. The attack impacts all services running on the device until it is rebooted or recovered.