CVE-2025-55036CWE-787

CVE-2025-55036

High · published October 15, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

⚡ An undisclosed traffic hiccup in BIG-IP SSL Orchestrator can trigger memory corruption on a virtual server! This means your system could experience unexpected behavior. 🔥 Think of it like a traffic jam of data packets that causes the road (or memory) to buckle and break under pressure. When the proxy connect feature is enabled, this jam can lead to serious issues that affect the entire route! If exploited, this vulnerability could cause your server to crash or behave erratically, leaving your organization vulnerable to downtime or data loss. A memory corruption issue like this could allow for unpredictable results, making it a high-priority concern!

Put simply

Think of it like a traffic jam of data packets that causes the road (or memory) to buckle and break under pressure. When the proxy connect feature is enabled, this jam can lead to serious issues that affect the entire route! This flaw in BIG-IP SSL Orchestrator occurs when the explicit forward proxy is set up on a virtual server. When traffic flows through, certain undisclosed conditions can lead to memory corruption, potentially allowing malicious activities.

What to do

If exploited, this vulnerability could cause your server to crash or behave erratically, leaving your organization vulnerable to downtime or data loss. A memory corruption issue like this could allow for unpredictable results, making it a high-priority concern! To protect your systems, audit your BIG-IP SSL Orchestrator configurations. If you're using an affected version, patch it to the latest release as soon as possible. Don't forget to monitor your server for unusual activity! You've got this! Follow these steps, and you'll be well on your way to securing your environment! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-10-15T18:15Z
Affected products (3)
ProductVersionsFixed in
f5/big-ip_ssl_orchestrator≥ 15.1.0, < 15.1.10.815.1.10.8
f5/big-ip_ssl_orchestrator≥ 16.1.0, < 16.1.616.1.6
f5/big-ip_ssl_orchestrator≥ 17.1.0, < 17.1.317.1.3
References (1)
EPSS history
Timeline
  • 15 OCT 13:55Z
    BIG-IP SSL Orchestrator vulnerability
    cvelistv5