EUVD-2026-81113
GHSA-2x4m-98h8-xp8g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable sftunnel frames (AV:N/AC:L/PR:N/UI:N) cause availability-only impact (A:H, C:N/I:N); I assess S:U since memory exhaustion hits the targeted device itself, unlike Cisco's S:C.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device.
This vulnerability is due to improper management of memory resources during sftunnel TLS connection setup. An attacker could exploit this vulnerability by sending crafted sftunnel TLS frames to an affected device during the connection setup. A successful exploit could allow the attacker to exhaust the available memory on the affected device, which could result in a DoS condition.
AnalysisAI
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to send crafted sftunnel TLS frames to the affected device during TLS connection setup, meaning network reachability to the sftunnel inter-device communication service (TCP/8305) on a Cisco Secure FMC or FTD instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco addressed this set of sftunnel defects in its consolidated advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3), and upgrading both FMC and FTD to the fixed release identified there for your specific train is the complete fix - our assessment confirms that moving to Cisco's fixed release removes the condition, and exact per-train version numbers are deliberately not asserted here because they must be read from the advisory rather than inferred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco FMC and FTD deployments on the affected 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x, and 10.0.x trains and restrict access to the sftunnel listener on TCP/8305 to only trusted management hosts or subnets; verify that no unnecessary management-plane exposure exists and enable logging/alerting for sftunnel memory exhaustion or DoS symptoms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer d
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today