EUVD-2026-80887
GHSA-4fw2-5j8h-69f2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network attacker (PR:N/AV:N) gains root RCE and REST-API control; AC:H for the sftunnel-down precondition; S:C as compromise extends to managed FTD devices.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device.
This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector at boot time. An attacker could exploit this vulnerability by sending crafted packets to the AJP connector. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs on the affected device. Note: This vulnerability can be exploited only if the valid sftunnel connection between Cisco Secure FMC Software and Cisco Secure FTD Software is down.
AnalysisAI
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable ONLY when the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD is down - this is the decisive limiting condition (reflected as AC:H) and means the attack is not possible against a healthy, normally-connected deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue backed by strong signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified in the available data at time of analysis, so the first step is to consult Cisco advisory cisco-sa-fmc2-multivulns-HXgcqRG (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG) and Cisco TAC for the fixed FMC release and upgrade path, then apply it during a maintenance window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm affected Cisco Secure FMC Software deployments for CVE-2026-76420, verify the sftunnel between Cisco Secure FMC and Cisco Secure FTD is healthy, restrict access to the AJP connector to trusted management networks and FTD peers, block untrusted AJP traffic at the perimeter, and enable logging for sftunnel outages and AJP/REST API anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today