CVE-2026-42780
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files.
Risk Assessment
An attacker could gain control over critical system files, potentially leading to serious security breaches and system instability.
Recommendation
It is recommended to update the software to the latest version that has not reached End of Technical Support to minimize the risk associated with this vulnerability.
Other vulnerabilities in BIG-IP SSL Orchestrator
See all- CVE-2025-55036High
When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: EoTS versions not evaluated.
- CVE-2025-41430High
When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
Original NVD description (English source)
A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS