What is the CVSS score of CVE-2025-55036?

CVE-2025-55036 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-55036?

Within 24 hours, inventory all F5 BIG-IP devices running SSL Orchestrator and identify any configured as an explicit forward proxy with proxy connect enabled; if those instances are not essential, disable proxy connect or switch to transparent or inbound mode, and restrict network access to affected virtual servers. Within 7 days, open a case with F5 support to confirm exposure and obtain mitigation guidance, review HA/DR capacity for crash recovery, enable detailed logging and alerting for virtual server restarts, and evaluate whether affected services can be moved behind access controls or load balancers that can absorb outages. Within 30 days, track F5 advisories for a vendor-released patch, test any forthcoming fix in a staging environment, schedule maintenance windows to apply it as soon as available, and re-validate that no affected explicit forward proxy configurations remain without compensating controls. No vendor-released patch identified at time of analysis.

BIG-IP SSL Orchestrator CVE-2025-55036

HIGH

Out-of-bounds Write (CWE-787)

2025-10-15 f5sirt@f5.com

Buffer Overflow Memory Corruption Big Ip Ssl Orchestrator

8.7

CVSS 4.0 · Vendor: f5

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach proxy-mode virtual server over network
Delivery

Send crafted undisclosed traffic
Exploit

Trigger out-of-bounds write in proxy handler
Execution

Corrupt process memory
Impact

Crash/degrade SSL Orchestrator data plane

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the BIG-IP device to have SSL Orchestrator configured as an explicit forward proxy on a virtual server AND the proxy connect feature enabled - both are explicit, non-default prerequisites stated in the advisory. Devices without SSL Orchestrator, or running it in transparent/inbound modes, or without proxy connect, are not affected. No authentication or user interaction is needed once that configuration is present (PR:N/UI:N), and End-of-Technical-Support software versions were not evaluated, so status on EoTS versions is indeterminate. The practical limiting factor is the specific proxy configuration, not attacker privilege.
Impact	Signals are consistent and point to a genuine but bounded (availability-only) risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated trigger, but impact is confined to availability (VC:N/VI:N/VA:H) - this is a denial-of-service via memory corruption, not remote code execution, despite the CWE-787 (out-of-bounds write) classification. EPSS is low at 0.35% (26th percentile), there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active or imminent widespread exploitation. The most important mitigating signal is NOT in the raw CVSS score: exploitation requires a specific, non-default configuration (explicit forward proxy plus the proxy connect feature), which sharply narrows the exposed population below what AV:N/PR:N alone would imply. Net: treat as a prioritized patch for the subset of F5 BIG-IP deployments running SSL Orchestrator in explicit forward proxy mode, but not an emergency for the general population given availability-only impact and low exploitation probability.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends crafted ('undisclosed') traffic through a BIG-IP virtual server configured as an SSL Orchestrator explicit forward proxy with proxy connect enabled, triggering an out-of-bounds write / memory corruption. This disrupts the affected data-plane process, degrading or denying proxy service for clients behind the device. No public proof-of-concept is referenced, and the assessed impact is loss of availability rather than code execution or data exposure.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Memory corruption in F5 BIG-IP SSL Orchestrator (CWE-787 out-of-bounds write) lets unauthenticated remote attackers crash a virtual server when SSL Orchestrator is configured as an explicit forward proxy with the proxy connect feature enabled, producing a high availability impact with no confidentiality or integrity loss. The prerequisites are explicit and non-default - devices without SSL Orchestrator, running it in transparent or inbound mode, or with proxy connect disabled are not affected - and F5 notes that End-of-Technical-Support versions were not evaluated. Risk signals are low: EPSS is 0.35% (26th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, though the vendor's description of 'undisclosed traffic' triggering the corruption leaves the exact trigger uncharacterized.

RemediationAI

No vendor-released patch version is documented in the provided intelligence, so the authoritative first step is to consult the F5 advisory https://my.f5.com/manage/s/article/K000151368 and apply the fixed BIG-IP maintenance release that F5 lists for the affected branch; upgrade any EoTS versions to a supported branch, since F5 explicitly did not evaluate EoTS releases and they will receive no fix. If an immediate upgrade is not possible, the most direct mitigation is to disable the proxy connect feature on any virtual server running SSL Orchestrator as an explicit forward proxy - this removes the vulnerable code path, but it also breaks CONNECT-based tunneling, so clients relying on HTTPS-through-the-proxy will fail until the setting is restored. A second option is to stop running the affected virtual servers in explicit forward proxy mode and use transparent or inbound SSL Orchestrator modes instead, which are outside the vulnerable configuration at the cost of requiring client reconfiguration or network redirection. Because the vector is PR:N/UI:N, exposure reduction must come from network controls: restrict access to the proxy virtual servers with firewall rules or ACLs so only trusted client subnets can reach them, accepting that this only shrinks the attack surface rather than eliminating the flaw. Finally, monitor for TMM restarts, memory exhaustion, traffic-group failovers, and proxy-connect-related crash signatures as indicators of attempted or successful exploitation, and note that the low EPSS score and absence of KEV or public exploit code do not remove the need to remediate configuration-exposed systems.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is an out-of-bounds write (CWE-787) in the BIG-IP SSL Orchestrator traffic-processing path for explicit forward proxy deployments. SSL Orchestrator is F5's TLS visibility and service-chaining module: it intercepts, decrypts, and steers encrypted flows through security service chains. In explicit forward proxy mode, clients are deliberately configured to send their requests to the BIG-IP virtual server, and the optional 'proxy connect' feature processes HTTP CONNECT requests used to establish tunnels to destinations - a parser-heavy code path that handles attacker-influenced header and tunnel data. F5 states that unspecified/undisclosed traffic in this configuration causes memory corruption, consistent with insufficient bounds validation of proxy-connect input reaching a memory write. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with VC:N/VI:N and VA:H only) confirms a remotely reachable, no-privilege, no-interaction trigger whose sole consequence is availability (process/daemon crash or resource loss), corroborated by the independent CVSS 3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The CPE data (cpe:2.3:a:f5:big-ip_ssl_orchestrator, version fields wildcarded) identifies BIG-IP SSL Orchestrator as the affected component but does not enumerate the vulnerable release ranges in the supplied intelligence.

Know when Big Ip Ssl Orchestrator gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.5 HIGH

Remote unauthenticated crafted traffic with no interaction (AV:N/AC:L/PR:N/UI:N); memory corruption yields denial of service only, so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive ViewAI

Why It Matters

A high-severity memory corruption flaw in F5 BIG-IP SSL Orchestrator can cause virtual server crashes and service outages for organizations that have deployed it as an explicit forward proxy with the proxy connect feature enabled. The risk is limited to that specific non-default configuration, and there is no public exploit identified at time of analysis, but no vendor patch is available, so affected teams should identify exposure and apply interim mitigations. Leadership should prioritize availability protection for any business-critical SSL Orchestrator deployments matching the affected setup.

Business Impact: Medium

Compensating Controls

Disable the proxy connect feature and avoid explicit forward proxy configuration; run SSL Orchestrator in transparent or inbound mode where possible; restrict network access to affected virtual servers; monitor for crashes and maintain HA/DR readiness; track F5 advisory for updates.

Threat Intelligence Overview

EPSS Score

0.3%

Top 74% exploitable

Prevalence

Medium

widely-used F5 appliance, but SSL Orchestrator proxy mode is a licensed subset

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.