EUVD-2026-81116
GHSA-xpr9-grjf-6fm6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web mgmt (AV:N/AC:L), PR:L because the minimum Security Analyst read-only role is required, no UI; deserialization yields root code exec so C/I/A:H; S:U kept per Cisco though app→root arguably S:C.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level.
This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP payload. A successful exploit could allow the attacker to save the crafted payload and then execute it on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
AnalysisAI
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) network reachability to the FMC web-management interface and (2) valid credentials for a user account with at least the Security Analyst (read-only) role - the lowest-privilege FMC role, so this is a very weak barrier rather than an admin gate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a genuinely severe, network-reachable authenticated deserialization flaw yielding root code execution - the technical impact is total (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The provided intelligence does not specify an exact fixed release: no vendor-released patch version is confirmed at time of analysis, and the only remediation source is Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx (cisco-sa-fmc-mulivulns-4PsnFwvx), which should be consulted directly for the applicable fixed software matrix and upgrade path - do not assume any listed 7.x/10.0.x build is remediated without that confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Secure Firewall Management Center appliance across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, and 7.6.x release lines, immediately restrict management-interface reachability to a dedicated segmented administrative network or VPN with MFA, remove any internet-facing exposure, and audit all FMC accounts holding the Security Analyst role or equivalent read-only privileges so that stale, shared, or unnecessary credentials are disabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authent
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today