EUVD-2026-81120
GHSA-g9vq-7qf2-jm65
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Unauthenticated remote token forgery (AV:N/AC:L/PR:N/UI:N); demonstrated impact is admin login (I:L) and indefinite administrator lock-out (A:H), with vendor-asserted C:N retained though arguably conservative.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user.
This vulnerability is due to improper management of the Cisco ASDM SSO token. An attacker could exploit this vulnerability by performing session token forgery techniques. A successful exploit could allow the attacker to log in as the administrator user and, by repeating this action, keep legitimate administrators locked out of the ASDM indefinitely.
AnalysisAI
Session-token forgery in the Cisco Secure Firewall Management Center (FMC) ASDM single sign-on handler lets an unauthenticated, remote attacker authenticate as the ASDM administrator user without any credentials or user interaction, and by repeating the forgery keep legitimate administrators locked out of ASDM indefinitely. The flaw stems from improper management of the ASDM SSO token (CWE-1259, improper restriction of security token inheritance), and it affects FMC releases across the 7.0.x through 7.7.x lines as well as 10.0.x per EUVD. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Cisco Secure FMC ASDM single sign-on handler and the ability to perform session-token forgery against the ASDM SSO token; no credentials, user interaction, or special privileges are needed (PR:N/UI:N), and it works against affected FMC releases in their standard configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority despite the absence of exploitation telemetry. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco has published vendor guidance for this issue in security advisory cisco-sa-fmc2-multivulns-HXgcqRG (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG); the provided data does not enumerate an exact fixed release, so obtain the fixed-version mapping for your specific FMC train (7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x or 10.0.x) directly from that advisory and upgrade to the listed fixed build for your branch before considering the instance mitigated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to the FMC/ASDM management interface to only trusted administrative networks using firewall rules or VPN, enable and review detailed logging of ASDM authentication and session events, and check for any unauthorized administrator sessions or configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Share
External POC / Exploit Code
Leaving vuln.today