EUVD-2026-80887
GHSA-4fw2-5j8h-69f2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AJP connector over network
-
DeliveryWait for sftunnel FTD link down
-
ExploitSend crafted AJP packets impersonating peer
-
ExecutionBypass encryption/peer authentication
-
PersistExecute commands as root
-
ImpactControl FMC REST APIs and managed devices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable ONLY when the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD is down - this is the decisive limiting condition (reflected as AC:H) and means the attack is not possible against a healthy, normally-connected deployment. The attacker must also have network reachability to the AJP connector of the FMC. Beyond that, no authentication or user interaction is required (PR:N/UI:N); the flaw stems from incorrect initialization of the AJP connector's encryption parameters at boot time, allowing crafted AJP packets to impersonate a peer device and reach root/REST-API control. |
| Impact | This is a genuinely high-priority issue backed by strong signals. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (9.0) describes an unauthenticated (PR:N), network-reachable (AV:N) flaw that yields root command execution and full control of the FMC REST APIs, with a scope change (S:C) reflecting compromise of the managed FTD devices - a serious, well-formed critical rating from Cisco PSIRT, a high-quality source. The key mitigating signal is AC:H, which correctly encodes the precondition stated in the note: exploitation is only possible while the sftunnel connection between FMC and FTD is DOWN, a transient/abnormal state rather than the steady-state deployment. Exploitation status: no public exploit identified at time of analysis - no KEV listing, no POC reference, and no EPSS score were provided, so there is no evidence of active exploitation despite the critical severity. No SSVC data was provided. The signals are not conflicting: high CVSS but no exploitation evidence yet, which is typical for a freshly disclosed vendor-reported bug. Net: treat as a priority to patch given root/RCE impact and unauthenticated network vector, but the AC:H sftunnel-down precondition meaningfully narrows the realistic window of exploitability. |
| Exploit ScenarioDerived | While the sftunnel management tunnel between a Cisco Secure FMC and its managed FTD is down, a remote unauthenticated attacker with network reach to the AJP connector sends crafted AJP packets that abuse the incorrectly initialized encryption parameters to impersonate a legitimate peer device. Because the connector trusts the impersonated peer, the attacker executes commands as root and gains full control of the FMC REST APIs. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.
RemediationAI
No vendor-released patch version was identified in the available data at time of analysis, so the first step is to consult Cisco advisory cisco-sa-fmc2-multivulns-HXgcqRG (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) and Cisco TAC for the fixed FMC release and upgrade path, then apply it during a maintenance window. Because exploitation requires the sftunnel between FMC and FTD to be down, the most effective compensating control is availability of that tunnel: monitor sftunnel state with alerting on any transition to down, restore connectivity promptly, and investigate unexplained or repeated tunnel outages as potential pre-attack conditions. In parallel, restrict network reachability to the AJP connector (typically TCP/8009) so that only trusted management subnets or the legitimate front-end peer can reach it, using firewall rules, ACLs, or interface-level restrictions; the trade-off is that incorrect scoping can break legitimate proxied management traffic, so validate rule changes against current flows. If AJP is not required for the deployment, disable or remove the AJP connector - this eliminates the attack surface entirely but is only viable where no application depends on AJP. Where FMC offers it, ensure the connector's required shared-secret/authentication settings are explicitly configured and verified after every reboot, since the defect is a boot-time initialization failure; note that this is a hardening measure and not a guaranteed fix for the underlying flaw. Ensure administrative access to the FMC management interface and any REST API exposure is limited to trusted networks, and review FMC logs for anomalous AJP-sourced requests and unexpected root-level or REST API activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the AJP connector embedded in Cisco Secure FMC Software - AJP is the binary protocol (historically Tomcat's AJP13 on TCP/8009) used by a front-end web server to forward requests to a Java servlet container, and it supports an encrypted/shared-secret handshake so that the connector only accepts traffic from a trusted peer. Here the encryption parameters for that connector are initialized incorrectly at boot time, so the connector's authorization check on peer identity is effectively bypassed - CWE-285, Improper Authorization. Because the peer-impersonation check is what the cryptography is meant to enforce, an attacker who can craft AJP packets can present as a legitimate peer, and from that position the attacker reaches an execution context with root privileges and control over the FMC REST APIs. The sftunnel (Cisco's secure tunnel between the FMC management plane and FTD devices) is the operational constraint: the defect only becomes reachable when that tunnel is down, which the CVSS vector expresses as AC:H and the advisory calls out explicitly as an exploitation precondition, distinct from authentication or user-interaction requirements (PR:N/UI:N).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network attacker (PR:N/AV:N) gains root RCE and REST-API control; AC:H for the sftunnel-down precondition; S:C as compromise extends to managed FTD devices.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device.
This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector at boot time. An attacker could exploit this vulnerability by sending crafted packets to the AJP connector. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs on the affected device. Note: This vulnerability can be exploited only if the valid sftunnel connection between Cisco Secure FMC Software and Cisco Secure FTD Software is down.
Articles & Coverage 1
Executive ViewAI
Cisco Secure FMC Software is exposed to a critical, unauthenticated authorization flaw that could let an attacker take root-level control of the FMC platform and its REST APIs, disrupting centralized firewall management across the organization. The risk is conditional on a failed sftunnel link between FMC and FTD, so a healthy, normally connected deployment is not exploitable, but any outage in that link could create a window for compromise. Leadership should care because no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so network restrictions and monitoring are the primary near-term defenses.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict AJP connector access on Cisco Secure FMC Software to trusted Cisco Secure FTD peers and management networks; block AJP from untrusted networks; keep the sftunnel between FMC and FTD up and monitor for unexplained outages; enable detailed AJP and FMC REST API logging; review API activity for unauthorized changes; disable AJP where operationally feasible; and apply Cisco-provided workarounds if released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB