Cisco Secure FMC Vulnerability Summary: CVE-2026-76420, CVE-2026-76412, CVE-2026-76413

Cisco Secure FMC Software Vulnerability Key Information Summary I. Vulnerability Overview Advisory ID: cisco-sa-fmc2-multivuln-HXqcrQ3 Severity Level: Critical First Published: 2026-09-16 16:00 GMT Number of Vulnerabilities: Multiple, including: - CVE-2026-76420: Cisco Secure FMC Software Peer Impersonation Vulnerability (Configuration flaw within the Apache JServ Protocol (AJP) connector allows an unauthenticated remote attacker to impersonate peer devices) - CVE-2026-76412: Cisco Secure FMC Software Privilege Escalation to root Vulnerability (Flaw in the remote diagnostic debugger permission checks allows an authenticated attacker to escalate privileges to root) - CVE-2026-76413: Cisco Secure FMC Single Sign-On Token Forgery Vulnerability (Flaw in ASDM Single Sign-On token management allows an unauthenticated attacker to forge tokens and impersonate administrators) CVSS Score: Base Score 9.0 (Critical) Impact: Remote attackers can gain remote access privileges, perform session forgery/session insertion; no known mitigations (workarounds) available. II. Scope of Impact Affected Products: Cisco Secure FMC software (independent of device configuration; all versions are affected). Confirmed Unaffected Products: - Secure Firewall Adaptive Security Appliance (ASA) software - Secure Firewall Threat Defense (FTD) software Vulnerability Details: - CVE-2026-76420: Incorrect initialization of encryption parameters in the AJP connector. An attacker can send specially crafted packets to the AJP connector to execute commands and fully control the FMC REST API. Exploitable only when a valid link connection exists between FMC and FTD and the FTD software is down. - CVE-2026-76412: Flaw in the remote diagnostic debugger when checking caller privileges. An authenticated attacker can escalate privileges to root after authenticating via the Web management interface or REST API; CVSS 3.1 attack complexity is High. - CVE-2026-76413: Improper management of ASDM SSO tokens. An attacker can indefinitely lock out legitimate administrators using session token forgery techniques. III. Remediation Patched Software: Cisco has released software updates to address the aforementioned vulnerabilities. No known mitigations (workarounds) are available. Recommended Actions: 1. Use the Cisco Software Checker tool to determine the optimal patched version (supports ASA, Secure FMC, and Secure FTD software). 2. Refer to documentation such as Cisco Secure Firewall ASA Compatibility, Upgrade Guide, and Compatibility Guide. 3. Monitor the Cisco Secure Firewall Adaptive Security Appliance Software Hardening Release (released September 2026). Source: Reported by independent security researcher Nicholas Michael Kloster. Exploitation and Public Disclosure: Cisco PSIRT has not received any reports of public disclosure or malicious exploitation of these vulnerabilities. IV. POC / Exploitation Code This page does not contain POC code or exploitation code blocks; it only describes the vulnerability mechanisms and exploitation conditions in text.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Secure FMC Vulnerability Summary: CVE-2026-76420, CVE-2026-76412, CVE-2026-76413