This vulnerability (CVE-2026-42780) in F5 BIG-IP SSL Orchestrator involves improper limitation of a pathname to a restricted directory (CWE-22), enabling an authenticated attacker with high privileges to perform directory traversal attacks. This allows overwriting, deleting, or corrupting arbitrary local files on the affected system. The vulnerability affects several versions of BIG-IP and has a CVSS 3.1 base score of 4.9, indicating medium severity. No official patch or remediation level has been published by the vendor, and no exploits are currently known in the wild.

An attacker with high privilege authentication can exploit this vulnerability to modify local files arbitrarily, potentially leading to integrity issues on the affected system. There is no direct impact on confidentiality or availability reported. The ability to overwrite or delete files could disrupt normal operations or compromise system integrity depending on which files are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted administrators only and monitor for suspicious activity related to file modifications. Avoid using affected versions if possible or deploy compensating controls to limit exposure.