EUVD-2026-81139
GHSA-f2cp-mvp8-7wp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent access to management segment
-
DeliveryDisrupt or await sftunnel connection loss
-
ExploitConnect to sftunnel port with crafted TLS cert
-
ExecutionBypass peer certificate validation
-
PersistRegister as trusted sftunnel peer
-
ImpactObtain manager-role root-equivalent control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Exploitation requires adjacent access to the sftunnel inter-device management channel between a Cisco Secure FMC and its managed FTD devices (AV:A) - the attacker must be able to reach the sftunnel port on the same or a reachable management segment. The critical limiting condition, explicitly stated by Cisco, is timing: the attack succeeds ONLY if the sftunnel connection is already down, or the attacker can disrupt/hold it down long enough to complete the crafted-TLS-certificate handshake and register as a peer (this is the basis for AC:H). No authentication or user interaction is needed (PR:N/UI:N), and default configurations are affected since improper TLS certificate management is inherent to the protocol implementation. Defenders who isolate the FMC/FTD management plane on a dedicated out-of-band network substantially reduce realistic exposure. |
| Impact | This is a genuinely serious flaw that warrants prioritized patching, though not an automatic emergency. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3) shows an unauthenticated attacker (PR:N) gaining scope-changing (S:C) full compromise at manager/root level - the highest possible technical impact on a security-control appliance. Two factors temper the raw score: the vector is adjacent (AV:A), not network-routable, requiring the attacker to already sit on the sftunnel management segment; and AC:H reflects a real race condition - per the vendor note, exploitation only succeeds while the sftunnel connection is DOWN or the attacker can disrupt it long enough to win the TLS handshake. No EPSS, KEV, or POC signals are present in the input: exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both agree on adjacent, unauthenticated, high-impact. The main uncertainty is EUVD lists affected versions but the input provides no confirmed fixed version; consult the Cisco advisory (cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3) for patched trains. Net: high priority for anyone whose FMC/FTD management plane is not strictly isolated, lower for those with hardened out-of-band management networks. |
| Exploit ScenarioDerived | An attacker with a foothold on the FMC/FTD management network waits for or forces a disruption of the sftunnel management connection between the FMC and a managed FTD device. During that window they connect to the sftunnel port presenting a crafted TLS certificate that the peer fails to properly validate (CWE-295), registering themselves as a legitimate sftunnel peer with manager-role (root-equivalent) access. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
RemediationAI
Patch status for this CVE is not confirmed from the data provided; Cisco has not published an exact fixed version in the supplied sources, so administrators should consult the vendor advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3 for the current fixed-release matrix and apply the recommended upgrade to both FMC and its managed FTD devices, since the sftunnel protocol is implemented on both sides. Until a fixed release is deployed, the highest-value compensating control is to isolate the FMC/FTD management and sftunnel plane on a dedicated, out-of-band management network with strict ACLs so that only known manager and managed-device addresses can reach the sftunnel service - this directly removes the AV:A adjacency the attack depends on, at the cost of re-architecting management connectivity and potentially complicating remote administration. Second, because exploitation requires the sftunnel connection to be down or disrupted, monitor sftunnel session state and reconnection events and alarm on unexpected or repeated tunnel drops and on new peer registrations from unrecognized addresses; this is detective rather than preventive and will not stop a well-timed attack. Third, remove or tightly control any host on the management segment that is not an FMC or FTD peer (jump hosts, monitoring appliances, contractor laptops), since any such system can potentially reach the sftunnel port; this reduces exposure but may disrupt legitimate management tooling and should be validated against operational requirements. If an unexpected sftunnel peer is observed, treat the FMC and any peer FTD as potentially root-compromised, rotate management credentials and certificates, and rebuild from known-good images rather than relying on in-place cleanup.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is sftunnel, the inter-device communication protocol that links a Cisco Secure Firewall Management Center (FMC) with the Cisco Secure Firewall Threat Defense (FTD) devices it manages, and which carries configuration and management traffic over a TLS-protected connection. The root cause class is CWE-295 (Improper Certificate Validation): the software does not properly manage/validate the TLS certificate used to authenticate the sftunnel management connection, so an attacker who presents a crafted TLS certificate to the sftunnel port can be accepted as a legitimate peer. Successful registration yields access at the manager role, which Cisco describes as equivalent to root on the peer device, and the CVSS scope-change (S:C) reflects that the compromise of the trusted management channel extends impact beyond the vulnerable component itself to the managed infrastructure. The prerequisites are what temper the risk: the attacker must be adjacent to the sftunnel path (AV:A, i.e. on the same or a reachable management segment) and must be able to exploit a window in which the sftunnel connection is down or to force/hold it down for the duration of the attack, which is why attack complexity is rated High. Both FMC and FTD software are listed in the CPE data (cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc) and cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software), confirming that the defect affects the protocol implementation on both sides of the tunnel rather than a single product build.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent management-segment access (AV:A) and the sftunnel-down race condition justify AC:H; no auth or interaction (PR:N/UI:N); peer impersonation compromises the managed devices (S:C) at root (C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager role, which is equivalent to root.
This vulnerability is due to improper management of the TLS certificate for the sftunnel management connection. An attacker could exploit this vulnerability by connecting to the sftunnel port using a crafted TLS certificate. A successful exploit could allow the attacker to become a registered sftunnel peer with root access. Note: The attack is successful only if the sftunnel connection is down or the attack can disrupt the sftunnel connection long enough to execute the attack.
Executive ViewAI
A high-severity flaw in Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) Software allows an attacker positioned on the adjacent network to impersonate a trusted peer on the sftunnel inter-device management channel and obtain manager-level (root-equivalent) control of the firewall management plane. No credentials or user interaction are required, and default configurations are affected, meaning any organization with FMC/FTD management traffic that is reachable outside a dedicated out-of-band network is exposed. A compromise of this plane would let an adversary alter firewall policy and security controls across the estate, so leadership should treat it as a priority remediation item even though no public exploit code has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate the sftunnel inter-device management channel on a dedicated out-of-band network segment; restrict access to sftunnel traffic so only known peer FMC/FTD devices can reach it; block adjacent-network access to the management plane; monitor sftunnel connection drops and peer registration events for signs of a crafted-certificate handshake attempt.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB