Cisco Secure FMC EUVD-2026-81120

Exploitation requires network reachability to the Cisco Secure FMC ASDM single sign-on handler and the ability to perform session-token forgery against the ASDM SSO token; no credentials, user interaction, or special privileges are needed (PR:N/UI:N), and it works against affected FMC releases in their standard configuration. The practical limiting factors are network exposure of the ASDM/FMC management interface (management planes are frequently restricted to internal or dedicated networks, which reduces real-world reachability) and running an affected FMC version (7.0.x through 7.7.x and 10.0.x per EUVD). The demonstrated impact is administrator login and indefinite lock-out of legitimate administrators rather than confirmed data exfiltration.

This is a genuine priority despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated attack requiring no user interaction - the most dangerous exposure profile for a security-management appliance. The vulnerability (CWE-1259, improper restriction of security-token assignment) lets an attacker forge the ASDM SSO token and authenticate as the administrator, and by repeating the forgery indefinitely lock legitimate administrators out (hence A:H). Vendor scored impact as C:N/I:L/A:H; the I:L/A:H combination plus the described 'log in as the administrator user' outcome makes the 8.2 (High) score credible, and the C:N is notably conservative given that ASDM admin access to a firewall-management plane would normally expose configuration. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no confirmed active exploitation and no evidence of automated weaponization yet - the risk is driven by the flaw's intrinsic exploitability (unauth, remote, low-complexity) rather than observed in-the-wild activity. Conflict to note: the 'Information Disclosure' tag contradicts the C:N vector - this is an authentication-bypass / availability issue, not disclosure.

A remote attacker with no credentials reaches the ASDM SSO login endpoint of an exposed Cisco Secure FMC and forges a valid SSO session token, authenticating as the ASDM administrator. By repeatedly re-forging tokens the attacker can keep legitimate administrators locked out of ASDM indefinitely, degrading management of the firewall estate. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make practical exploitation straightforward once the token-forgery technique is understood.