CVE mitigation on F5 XC vs classic F5 WAF

Forums Technical Forums
,
1

Hi,

there is serious CVE out there:

https://www.cve.org/CVERecord?id=CVE-2025-55182

And F5 reacted quickly: myF5

F5 itself is not affected, but F5 company created signatures addressing this issue. But it seems they are NOT available in F5 XC. That leads me to thinking what is the process, what can we expect? We have deployed signatures on some onsite environments, but how about services behind F5 XC?

Thanks,

Zdenek

2

F5 XC support replied it is installed automatically by F5:

Attack Signatures | F5 Distributed Cloud Technical Knowledge

Attack Signatures Changelog | F5 Distributed Cloud Technical Knowledge

3

Yes that is how XC with AWAF works. Any new signatures are auto added. Changed and new signatures enter 1 week staging as shown in WAF Signature Staging in F5 Distributed Cloud and you need to use the XC API to see them (no GUI option for some reason) https://docs.cloud.f5.com/docs-v2/api/waf-signatures-changelog

Maybe for this one as it is bad XC added it to blocking even for WAF policies that have staging enabled from the start but I suggest using the XC API to check.

When you said XC doesn’t have the signature where did you actually check this as I know only of Attack Signatures | F5 Distributed Cloud Technical Knowledge ?

4

You even use the dev portal by adding your tenant and after that authorizing it with credentials to see this without a need of CURL or Postman: