CVE-2026-76412

Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability

No known exploitation. EPSS puts it in the 39th percentile. No fix published yet.

CVSS 3.18.5High EPSS percentile39th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.157966

Run the check

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Cisco Secure Firewall Management CenterAffected: 7.7.0Upgrade to: not statedAffected: 7.7.10Upgrade to: not statedAffected: 7.7.10.1Upgrade to: not statedAffected: 7.7.11Upgrade to: not stated + 3 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Confirm whether you run Cisco Secure Firewall Management Center and identify its installed software version.
Review all accounts with access and immediately disable unnecessary, shared, or former-staff accounts.
Ask Cisco or your support provider for the fixed software version; no patch or fixed version information is currently available.
Restrict the management website and API to trusted administrator networks while awaiting vendor guidance.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes: To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability.

In plain language

Written by AI from the record

A flaw in Cisco Secure Firewall Management Center can let a logged-in attacker take full control of the device, so small businesses using it should act now.

Authenticated remote privilege escalation to root in Cisco Secure Firewall Management Center through insufficient privilege checks in the remote diagnostics debugger.

If you're affected

Full device takeover
Security policy changes
Network monitoring disruption
Sensitive data exposure

What is it

This is a weakness in a management system used to oversee firewall security. It is like giving someone with a building access badge a way to obtain the master keys, allowing them to change protections or interfere with operations.

Who is affected

This matters to you if you run Cisco Secure Firewall Management Center to manage firewall devices. It is a risk only when an attacker already has a valid account that can access its management website or programming interface.

How urgent is it

A public exploit is available, giving an attacker with a valid account a practical way to attempt takeover. Treat this as urgent: reduce account access and limit management access while you obtain Cisco’s remediation guidance.

What to do — in detail

Confirm deployment by checking your Cisco Secure Firewall Management Center inventory and installed version, then identify every account permitted to use the management interface or REST API. There is no published fixed version or patch information available, so obtain the supported remediation path directly from Cisco or your service provider before scheduling an upgrade.

Until a fix is available, disable unneeded accounts, replace shared administrator accounts with named accounts, revoke access for departed staff, and restrict web-management and REST API access to a dedicated administrator network. If operationally feasible, disable or tightly restrict remote diagnostics access. Review account-privilege changes, newly enabled diagnostics services, unexpected administrator accounts, and management-interface/API activity for signs of misuse.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies.

Technical context

CVE-2026-76412 is rated CVSS 8.5 High (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). The weakness is CWE-264: insufficient privilege validation in the remote diagnostics debugger; an authenticated remote user can invoke remote diagnostics through the web management interface or REST API and elevate privileges to root. A public exploit is available, although CISA KEV does not list this CVE. EPSS is 0.3% at the 25th percentile with a flat trend; this is predictive scoring, not confirmation of in-the-wild exploitation. Exploitation requires valid credentials and a multistage process, reflected in the High attack-complexity rating.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS39th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 39th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 36 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-09-18Record updated
2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Secure Firewall Management Center (FMC)Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 8.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-264No name in the record

Sources

References in the record

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG

In the news

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active AttacksThe Hacker News · 2026-09-17

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Cisco, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account