EUVD-2026-81116
GHSA-xpr9-grjf-6fm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-priv FMC credentials
-
DeliveryAuthenticate to web management
-
ExploitSend crafted HTTP serialized payload
-
ExecutionInsecure deserialization saves object
-
PersistTrigger deserialized object
-
ImpactExecute arbitrary commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network reachability to the FMC web-management interface and (2) valid credentials for a user account with at least the Security Analyst (read-only) role - the lowest-privilege FMC role, so this is a very weak barrier rather than an admin gate. The attacker must send a crafted HTTP payload to the deserialization sink, save it, and trigger execution; no user interaction from a victim and no non-default configuration are needed. The only meaningful limiting factor is that the interface must be reachable and the attacker must be authenticated - FMC deployments that restrict web-UI access to trusted management networks and enforce strong credentials materially reduce exposure. |
| Impact | CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a genuinely severe, network-reachable authenticated deserialization flaw yielding root code execution - the technical impact is total (C:H/I:H/A:H). The single strongest amplifier is that PR:L is honest but the privilege bar is minimal: Cisco explicitly states the required role is 'Security Analyst (read-only),' the weakest FMC console role, so any credentialed user - not just administrators - can reach root. This narrows the gap between 8.8 and a full 9.9/10.0. Counterbalancing signals: exploitation status is 'no public exploit identified at time of analysis' (no CISA KEV entry, no POC, and no EPSS probability provided), so there is no evidence of active or automatable exploitation yet. SSVC-style read: exploitation=none-observed, technical-impact=total, but automatable is limited by the authentication requirement. Net: a real patching priority for any FMC exposed to semi-trusted operators, but not (currently) an emergency 'exploited-in-the-wild' item. S:U is per Cisco convention; a deserialization sink that pivots from the web app to root on the underlying OS is arguably a scope change (S:C), which would push the score higher - worth noting but not a scoring error. |
| Exploit ScenarioDerived | An attacker who holds (or phishes/brute-forces) any low-privilege FMC web account - as little as a read-only Security Analyst - logs in and submits a crafted HTTP payload containing a malicious serialized object. The application deserializes the attacker-controlled data insecurely, letting the attacker save the payload and then trigger it to run arbitrary OS commands as root on the FMC appliance. No public exploit code is identified at time of analysis, but the low required privilege and total impact make this attractive once a foothold or valid credentials are obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar - the least-privileged FMC role rather than an admin account - makes this a high-priority management-plane risk for internet- or broadly reachable deployments. Cisco Secure Firewall Management Center versions across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains are reported as affected.
RemediationAI
The provided intelligence does not specify an exact fixed release: no vendor-released patch version is confirmed at time of analysis, and the only remediation source is Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx (cisco-sa-fmc-mulivulns-4PsnFwvx), which should be consulted directly for the applicable fixed software matrix and upgrade path - do not assume any listed 7.x/10.0.x build is remediated without that confirmation. Because exploitation requires only network reachability to the FMC web-management interface plus credentials for at least the read-only Security Analyst role, the highest-value compensating controls are: (1) restrict administrative and web-UI access to FMC to a dedicated, tightly scoped management network or jump-host segment using ACLs/firewall rules - this removes the AV:N precondition and defeats the flaw entirely for off-network attackers, though it can complicate legitimate remote administration and requires disciplined change control; (2) enforce strong, unique passwords and MFA on all FMC accounts and audit for any account holding Security Analyst privileges - since that lowest-privileged role is sufficient to exploit, weak or shared read-only credentials are a direct path to root and should be rotated or removed; (3) review FMC user accounts for least privilege and disable dormant, contractor, or shared analyst accounts whose compromise would satisfy the authentication requirement; and (4) enable and monitor FMC audit logging for anomalous authenticated HTTP requests to web-management endpoints and any unexpected payload files or process spawns on the appliance, treating such events as a likely root-level compromise requiring rebuild rather than cleanup. None of these controls fix the underlying deserialization defect - they only reduce reachability and credential exposure, so applying Cisco's fixed release remains the required long-term action once identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data. FMC exposes a web-management interface whose request handling deserializes user-controlled data without adequately restricting the object types that can be reconstructed; because that code path runs with high privileges on the appliance, attacker-supplied serialized data can drive method/object graph execution and ultimately shell out on the host operating system as root. CPE data (cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc):*:*:*:*:*:*:*:*) confirms the affected platform is Cisco's Secure Firewall Management Center - the centralized policy, event, and device-management console for Cisco Secure Firewall (Firepower) appliances - rather than the managed firewalls themselves, so the exposure is to the management plane that holds configuration and credentials for the protected estate. The CVSS vector AV:N/AC:L/PR:L/UI:N indicates the attack is network-delivered, requires no special conditions or victim interaction, and needs only low-privilege credentials; the Security Analyst (read-only) role is described as the minimum sufficient privilege, so the exploit does not require administrative rights on FMC. Impact scope, per the assessed vector, is Unchanged (the compromise stays within the FMC security authority) but total for confidentiality, integrity, and availability, which is consistent with root code execution on the management appliance.
Know when Cisco Secure Firewall Management Center Fmc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web mgmt (AV:N/AC:L), PR:L because the minimum Security Analyst read-only role is required, no UI; deserialization yields root code exec so C/I/A:H; S:U kept per Cisco though app→root arguably S:C.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level.
This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP payload. A successful exploit could allow the attacker to save the crafted payload and then execute it on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
Executive ViewAI
Cisco Secure Firewall Management Center (FMC), the platform that defines and distributes firewall policy across the enterprise network, contains an authenticated remote code execution flaw that allows a user holding only the lowest-privilege read-only web role to gain root control of the appliance. Affected deployments span the 7.0.x, 7.2.x, 7.3.x, 7.4.x, and 7.6.x release lines, and no vendor patch is available yet, so any organization whose management interface is reachable beyond a tightly controlled network carries elevated risk to the confidentiality, integrity, and availability of its security infrastructure. Leadership should care because compromise of FMC effectively hands an attacker control over the network's enforcement layer along with the sensitive configuration and policy data it holds.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict FMC web-management access to a dedicated management network or VPN with MFA and remove internet-facing exposure; audit and minimize accounts holding the Security Analyst (read-only) role and rotate credentials; enforce strong authentication and session controls; segment the management plane from user and internet-reachable networks; and monitor and alert on anomalous FMC web requests, account activity, and unexpected root-level process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authent
Exploit-DB