Is there a patch available for CVE-2026-42780?

Yes, a patch is available for CVE-2026-42780. Update the affected software to the latest version immediately.

F5 BIG-IP SSL Orchestrator CVE-2026-42780

Q: What is the CVSS score of CVE-2026-42780?

CVE-2026-42780 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-30001 MEDIUM

Path Traversal (CWE-22)

2026-05-13 f5

GHSA-4m3x-cfc5-6ccg

Path Traversal Big Ip Ssl Orchestrator

6.9

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

4.9 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:52 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 4.9

DescriptionCVE.org

A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitrary local files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Directory traversal vulnerability in F5 BIG-IP SSL Orchestrator enables authenticated high-privilege attackers to overwrite, delete, or corrupt arbitrary local files via path manipulation. The vulnerability requires network access and valid high-privilege credentials but does not require user interaction, affecting the integrity of system files on affected BIG-IP instances. A vendor patch is available.

Technical ContextAI

BIG-IP SSL Orchestrator is F5's application delivery controller module that manages SSL/TLS traffic inspection and policy enforcement. The vulnerability stems from insufficient input validation on file path parameters (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), allowing authenticated administrators to manipulate path traversal sequences (e.g., '../') to access files outside the intended restricted directory. The affected product is identified via CPE strings cpe:2.3:a:f5:big-ip and cpe:2.3:a:f5:ssl_orchestrator, indicating the vulnerability resides within BIG-IP's SSL Orchestrator module or a dependent component.

RemediationAI

Apply the vendor-released patch from F5 advisory K000149743 (https://my.f5.com/manage/s/article/K000149743) to update BIG-IP to a patched version. Consult the F5 advisory for exact patched version numbers and compatibility with your deployment. As an interim compensating control pending patching, restrict administrative access to BIG-IP SSL Orchestrator to trusted personnel only and disable or restrict high-privilege API endpoints that accept file path parameters if the SSL Orchestrator feature is not actively in use. Monitor BIG-IP audit logs for suspicious file operations or path traversal patterns (sequences containing '../' or absolute paths in file operation requests) and alert on any high-privilege account activity targeting configuration or system files. Note that restricting SSL Orchestrator functionality may impact traffic inspection and policy enforcement capabilities.