EUVD-2026-81138
GHSA-cxq7-wwr3-xj8v
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated remote access over web UI/REST API gives AV:N/PR:L; the multistage exploit justifies AC:H; escalation from a low-priv context to root crosses a security boundary (S:C) with full C/I/A:H.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service.
This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes:
To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability.
AnalysisAI
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid authenticated user credentials on the FMC device (PR:L) and access to either the web-based management interface or the REST API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated privilege-escalation flaw, not a fire-drill. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data for CVE-2026-76412; the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG is the authoritative source for fixed software and should be checked for the corrected release for each 7.7.x and 10.0.x deployment before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Secure Firewall Management Center (FMC) appliance in the environment and confirm its current release, then restrict access to the FMC web management interface and REST API to a hardened administrative subnet or jump host rather than any routable address; simultaneously review the full list of accounts with management-interface or API access and revoke or downgrade any that do not genuinely require remote diagnostics capability, since that capability is the path to escalation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today