EUVD-2026-81113
GHSA-2x4m-98h8-xp8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach sftunnel port TCP/8305
-
DeliverySend crafted TLS setup frames
-
ExploitTrigger improper memory allocation
-
ExecutionExhaust device memory
-
ImpactDenial of service on FMC/FTD
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Exploitation requires the attacker to send crafted sftunnel TLS frames to the affected device during TLS connection setup, meaning network reachability to the sftunnel inter-device communication service (TCP/8305) on a Cisco Secure FMC or FTD instance. Per CVSS PR:N/UI:N no authentication or user interaction is needed. The key limiting factor is deployment topology: sftunnel is the FMC-to-managed-FTD control channel and is normally restricted to a management/out-of-band network, so realistic exploitation requires access to that segment rather than arbitrary internet reachability. Affected releases span FMC and FTD 7.0.x through 7.7.x and 10.0.x per EUVD; upgrading to Cisco's fixed release removes the condition. |
| Impact | This is a genuine but bounded availability risk. The Cisco-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6) describes an unauthenticated, low-complexity, remotely reachable memory-exhaustion DoS against the sftunnel channel of FMC/FTD - no confidentiality or integrity impact (C:N/I:N). There is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept in the provided data, so this is 'no public exploit identified at time of analysis' - not active exploitation. The 8.6 severity is driven entirely by A:H plus the scope-change flag (S:C); I consider S:C debatable because the memory exhaustion affects the targeted device itself rather than a distinct security authority, which would make the honest score closer to 7.5 (S:U) - verify scope intent with the Cisco advisory. The practical limiter absent from raw CVSS is reachability: sftunnel (TCP/8305) is the FMC↔FTD management channel and is normally confined to a management network, so 'remote unauthenticated' in practice means an attacker who can reach the management plane, which materially reduces real-world exposure versus an internet-facing service. Net: a real availability priority for firewall management infrastructure, but not a drop-everything emergency given no exploitation signal and management-plane exposure constraints. |
| Exploit ScenarioDerived | An attacker with network reachability to the sftunnel port (TCP/8305) on an FMC or FTD device sends a stream of crafted sftunnel TLS frames during connection setup, each triggering improper memory allocation/management. Sustained frames exhaust device memory, degrading or crashing management functions and disrupting the FMC-to-FTD control channel. No proof-of-concept is publicly available at time of analysis, and no authentication is required per the CVSS vector (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
RemediationAI
Cisco addressed this set of sftunnel defects in its consolidated advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3), and upgrading both FMC and FTD to the fixed release identified there for your specific train is the complete fix - our assessment confirms that moving to Cisco's fixed release removes the condition, and exact per-train version numbers are deliberately not asserted here because they must be read from the advisory rather than inferred. Where an immediate upgrade is not feasible, the highest-value compensating control is denying attackers reach to the sftunnel listener: restrict TCP/8305 so it is reachable only from the FMC instance(s) and FTD peers that legitimately form each management pair, enforced via management-plane ACLs, FTD control-plane interface ACLs, or inter-zone firewall policy, and keep that traffic confined to a dedicated out-of-band management segment or VPN rather than any internet-facing or user-facing interface. The trade-off is operational and immediate: any rule that blocks 8305 between an FMC and a managed FTD will break registration, policy deployment, health monitoring and eventing for that device, so ACL scope must be pinned to the real FMC/FTD peer addresses and ports. Because the attack is a memory-exhaustion DoS, monitor appliance memory utilization, concurrent sftunnel connection counts, and repeated TLS setup attempts toward 8305 sourcing from anything other than a known management peer, which provides detection where prevention is not yet in place; note that there is no supported configuration toggle that disables sftunnel while retaining FMC management of FTD devices, so segmentation and patching are the only realistic options.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
sftunnel is Cisco's proprietary TLS-based control channel that Firepower Management Center uses to manage, register, and push policy to Firepower Threat Defense devices; it listens on TCP/8305 and is an inter-device protocol rather than a user-facing service, which is why the CPE data covers both cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc):* and cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software:*. The flaw maps to CWE-789 (Memory Allocation with Excessive Size Value), a child of CWE-400 Uncontrolled Resource Consumption: during the TLS handshake and connection-setup phase the sftunnel code allocates memory based on values carried in attacker-supplied frames without enforcing sane ceilings or per-connection quotas, so each crafted connection consumes disproportionate memory and repeated frames steadily drain the appliance's available memory. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required, and because the outcome is pure resource exhaustion rather than memory corruption or an out-of-bounds write, the expected worst case is service unavailability, not code execution or data disclosure. One data-quality note worth flagging: the aggregated feed tags label this issue 'Information Disclosure', which contradicts both the advisory's description and the C:N/I:N/H:A vector; the availability-only, denial-of-service reading should be treated as authoritative. Cisco's own vector sets a scope change (S:C) while our assessment treats the impact as scope-unchanged (S:U), which accounts for most of the score difference between the vendor's 8.6 and a scope-unchanged equivalent - the access vector, privileges, and impact are otherwise identical.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable sftunnel frames (AV:N/AC:L/PR:N/UI:N) cause availability-only impact (A:H, C:N/I:N); I assess S:U since memory exhaustion hits the targeted device itself, unlike Cisco's S:C.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device.
This vulnerability is due to improper management of memory resources during sftunnel TLS connection setup. An attacker could exploit this vulnerability by sending crafted sftunnel TLS frames to an affected device during the connection setup. A successful exploit could allow the attacker to exhaust the available memory on the affected device, which could result in a DoS condition.
Executive ViewAI
Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) software across multiple release trains are affected by a remotely triggerable memory-exhaustion condition in the sftunnel service. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but an unauthenticated attacker with management-network access could degrade or disrupt firewall management and inspection availability, with no confidentiality or integrity impact. Leadership should care because sustained denial of service against these security appliances can interrupt network security operations and dependent business services until mitigations or a patch are applied.
No vendor-released patch identified at time of analysis; restrict network reachability to the sftunnel listener on TCP/8305 to trusted management hosts, enforce management-plane segmentation and ACLs, and monitor for memory exhaustion or denial-of-service conditions on affected FMC and FTD appliances.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Exploit-DB