F5 BIG-IP SSL Orchestrator CVE-2026-42780

Attacker must possess valid BIG-IP high-privilege authentication credentials (e.g., admin role or equivalent). The SSL Orchestrator module must be enabled and accessible on the BIG-IP instance. No special network configuration is required beyond network reachability to the BIG-IP management interface or SSL Orchestrator API endpoint. Non-authenticated users, standard users, or operators with lower privilege levels cannot exploit this vulnerability. Default BIG-IP configurations with SSL Orchestrator enabled and default admin accounts are exploitable if credentials are known or compromised.

CVSS 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U indicates network-accessible exploitation requiring high-privilege authentication, zero user interaction, and localized impact (scope unchanged). While the CVSS score is moderate, the integrity impact (I:H) combined with no confidentiality or availability impact suggests targeted file corruption rather than system-wide compromise. The high-privilege requirement (PR:H) significantly restricts the threat actor pool to administrators or operators with elevated BIG-IP access, making this a lower real-world risk than the CVSS alone suggests. The vulnerability is NOT listed as actively exploited or present in public exploit repositories at time of analysis. The availability of a vendor patch mitigates this risk for patched deployments. Organizations running end-of-technical-support BIG-IP versions are explicitly not covered by vendor evaluation per the CVE note, creating a legacy risk tier.

An authenticated BIG-IP administrator with high-privilege credentials (e.g., local admin or delegated management account) crafts a malicious API request or management console action to the SSL Orchestrator module, embedding path traversal sequences in a file path parameter. The request traverses outside the intended restricted directory to target a critical system file such as a configuration file, certificate store, or application binary, overwriting or deleting it to disrupt operations or introduce malicious configuration.