CVE-2025-48008
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Risk Assessment
This may lead to service unavailability on the affected device, posing a risk to the organization's continuity of operations.
Recommendation
Update the software to a version containing the fix or disable MPTCP in TCP profiles if not required.
Other vulnerabilities in Traffic Management Microkernel (TMM)
See all- CVE-2026-42920High
When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
- CVE-2026-42409High
CVE-2026-42409 affects the configuration of an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond commands on a virtual server. Undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.
- CVE-2026-34019Medium
A vulnerability in BFD (Bidirectional Forwarding Detection) configured in static and dynamic routing protocols causes undisclosed traffic to stop BFD packet processing by the Traffic Management Microkernel (TMM). This leads to a failover of the configured routing protocol.
- CVE-2025-61990High
When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-58120High
When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-54479High
When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
Original NVD description (English source)
When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS