CVE-2024-32761 BIG-IP TMM tenants on VELOS and rSeries vulnerability

Medium 6.5 Published 8 May 2024 Updated 3 Feb 2026

A random data leak in BIG-IP TMMs on VELOS and rSeries platforms may expose up to 64 bytes of data and cause service restarts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-32761?

CVE-2024-32761 is a medium-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 8 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Weakness: CWE-119

Which versions are affected by CVE-2024-32761?

It affects 21 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager and 15 more.

How do I fix CVE-2024-32761?

No fix has been published for CVE-2024-32761 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-32761 being exploited?

There is no known exploitation of CVE-2024-32761 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-v5mc-ffgc-f77v.