CVE-2025-55036
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: EoTS versions not evaluated.
Risk Assessment
Memory corruption can lead to system crashes, unexpected behavior, or potentially allow an attacker to execute code, posing a serious security risk.
Recommendation
Apply vendor patches for supported BIG-IP versions and monitor traffic for anomalies; if possible, disable proxy connect feature until patched.
Other vulnerabilities in BIG-IP SSL Orchestrator
See all- CVE-2026-42780Medium
A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files.
- CVE-2025-41430High
When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
Original NVD description (English source)
When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS