CVE-2026-42780

BIG-IP SSL Orchestrator vulnerability

MEDIUM

4.9

CVSS Score

Published: May 13, 2026 at 02:12 PM UTC

Updated: October 26, 2026 at 02:10 PM UTC

3 products affected across 1 vendorBig IP SSL OrchestratorBIG-IPSSL Orchestrator

Using BIG-IP by F5?

Get instant alerts when new vulnerabilities affect BIG-IP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Big IP SSL Orchestrator · F5

95%

17.1.0 ≤ v ≤ 17.1.317.5.0 ≤ v ≤ 17.5.121.0.0

BIG-IP · F5

90%

16.1.0 ≤ v < *17.1.0 ≤ v < 17.1.3.117.5.0 ≤ v < 17.5.1.521.0.0 ≤ v < 21.0.0.116.1.0 17.1.0 17.5.0 21.0.0

Affected range stops below 17.1.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.5.1.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.0.0.1, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 21.1.0 (unaffected)

SSL Orchestrator · F5

90%

11.0 ≤ v < 11.4.112.0 ≤ v < 12.3.213.0 ≤ v < 13.1.311.0 12.0 13.0

Affected range stops below 11.4.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.3.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.1.3, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 14.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://my.f5.com/manage/s/article/K000149743

References (1)

Vendor AdvisoryPatchMitigation

Source: cverecord

https://my.f5.com/manage/s/article/K000149743

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.9MEDIUMf5

Attack Vector: NETWORK
Complexity: LOW
Privileges: HIGH
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card