CVE Tools
Sign in

CVE-2026-76412

Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability

Published: Sep 16, 2026Updated: Sep 18, 2026 Sources: CVE List NVDCWE-264
8.5HIGH
NVD MITRE
EPSS Score
0.3%
Top 74.6%
CISA KEV
Not in KEV
Exploits
0 Known
Remediation
No Fix Available
Self-Check
Not available

Description

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes: To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability.

In plain language

AI Act now

A flaw in Cisco Secure Firewall Management Center can let a logged-in attacker take full control of the device, so small businesses using it should act now.

Executive summary

Authenticated remote privilege escalation to root in Cisco Secure Firewall Management Center through insufficient privilege checks in the remote diagnostics debugger.

If affected, business impact
Full device takeoverSecurity policy changesNetwork monitoring disruptionSensitive data exposure

What to do now

  1. Confirm whether you run Cisco Secure Firewall Management Center and identify its installed software version.
  2. Review all accounts with access and immediately disable unnecessary, shared, or former-staff accounts.
  3. Ask Cisco or your support provider for the fixed software version; no patch or fixed version information is currently available.
  4. Restrict the management website and API to trusted administrator networks while awaiting vendor guidance.
May need vendor / contractor work

CVSS Vector Breakdown

AV:NAC:HPR:LUI:NS:CC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:HAttack Complexity
High
PR:LPrivileges Required
Low
UI:NUser Interaction
None
Scope
S:CScope
Changed
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-264

Affected Products

Cisco
commercial·USaka cisco systems inc., cisco systems
Cisco Secure Firewall Management Center (FMC)
Networking Infrastructure

Exploitability

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Is your org exposed to CVE-2026-76412?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG
sec.cloudapps.cisco.com
News mentions
1

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-76412 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows