EUVD-2026-81126
GHSA-mxj5-v55g-6rm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FMC management API over network
-
DeliveryInvoke unauthenticated critical API
-
ExploitDownload restricted sensitive files
-
ExecutionRepeatedly invoke to consume disk
-
ImpactDevice becomes unresponsive (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the affected critical API on Cisco Secure Firewall Management Center (FMC); no authentication, no user interaction, and no special configuration are needed because the API lacks authentication entirely (CWE-306). The primary limiting factor is network exposure of the FMC management plane - organizations that restrict management-interface access to trusted administrative networks/jump hosts substantially reduce reachability. Applies to the enumerated FMC 7.3.x through 7.7.x and 10.0.x release trains. DoS requires sustained repeated invocation to exhaust disk; file download succeeds on a single unauthenticated call. |
| Impact | This is a genuine priority-worthy issue but with important nuance. The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects unauthenticated, low-complexity, network-reachable exploitation with no user interaction - the ideal profile for opportunistic scanning against internet- or management-network-exposed Cisco Secure FMC instances. However, there is a notable internal inconsistency: the description explicitly states an attacker can 'download sensitive files that should be restricted,' which is a confidentiality impact, yet the vendor's vector scores C:N and attributes the entire 7.5 to A:H (disk exhaustion DoS). This means the scored severity likely UNDER-represents the confidentiality risk; a defender reading only the vector would miss the file-disclosure primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation is theoretical/vendor-reported rather than observed. Given Cisco security appliances are a recurring target for mass exploitation and the missing-authentication root cause (CWE-306) is trivially automatable, this warrants prompt patching despite the absence of confirmed in-the-wild activity - treat as high real-world risk, not a paper CVSS. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the FMC management interface repeatedly invokes the exposed, authentication-free API to retrieve restricted sensitive files (potentially configuration or credential material) and to force unbounded disk writes. Sustained invocation exhausts disk space, rendering the firewall management platform unresponsive (DoS). No public exploit code is identified at time of analysis, but the missing-authentication design makes reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated file disclosure and disk-exhaustion denial of service in Cisco Secure Firewall Management Center (FMC) let a remote attacker pull sensitive files from a critical management API that performs no authentication checks. The vendor assigns CVSS 7.5, while our independent assessment scores it higher at CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H because the same missing-authentication flaw (CWE-306) yields both confidentiality and availability impact: a single unauthenticated call can exfiltrate restricted files, and sustained repeated invocation exhausts disk until the appliance becomes unresponsive. Affected release trains span FMC 7.3.0 through 7.7.12 plus 10.0.0 and 10.0.1 (tracked as EUVD-2026-81126); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary exposure limiter is network reachability to the FMC management plane.
RemediationAI
Vendor-released fixes are documented in Cisco's security advisory (cisco-sa-fmc-mulivulns-4PsnFwvx, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx); because the provided data does not enumerate an exact fixed version, administrators should open that advisory, map each deployed FMC build within the 7.3.x-7.7.x and 10.0.x ranges to the corresponding fixed software listed there, and upgrade - noting that this advisory bundles multiple FMC vulnerabilities, so a single upgrade pass can close several issues. Until patched, the most effective control is to remove reachability to the FMC management plane: place the management interface behind restrictive firewall ACLs or a dedicated management VLAN/jump-host segment that permits only trusted administrative source addresses, accepting the trade-off that administrators lose direct access from general corporate networks and remote/unmanaged clients. Do not expose the FMC management API to the internet or to broad internal subnets. Because the file-disclosure path succeeds on a single unauthenticated request, ACL segmentation should be treated as the primary containment measure rather than a monitoring-only control; supplement it by monitoring FMC disk utilization and API/HTTP access logs for anomalous repeated requests to unidentified endpoints, which can provide early warning of the DoS pattern and evidence of the file-download activity. No public exploit code was identified at time of analysis, but the absence of authentication means any discovery of the endpoint turns it into a trivial capability, so treat exposure as urgent even though CISA KEV status is not confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-306 (Missing Authentication for Critical Function) and sits in a REST/management API endpoint of Cisco Secure Firewall Management Center, the centralized configuration, policy, logging, and event-management console for Cisco Secure Firewall (FTD) deployments. Because the endpoint implements no authentication or authorization check at all, no credentials, session token, or user interaction are required - the CVSS vector PR:N/UI:N is confirmed by the authoritative assessment, so exploitation is fully unauthenticated. The API serves file content that should be restricted, so a single request returns sensitive data directly to the attacker (C:H in our reassessment versus the vendor's C:N). The same endpoint does not bound the resources it consumes, so repeated invocation fills the FMC disk and degrades the platform to a denial-of-service state (A:H in both the vendor and independent vectors). The product set is identified by CPE cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc):*:*:*:*:*:*:*:*, and ENISA's EUVD entry (EUVD-2026-81126) enumerates affected builds across the 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, indicating the vulnerable code has been carried forward across multiple maintenance releases. Practically, this is an unauthenticated, network-reachable, management-plane integrity-of-operations issue: exploitation succeeds only where the FMC management interface is reachable, which is why segmentation of the management network is the dominant risk-reduction control.
Know when Cisco Secure Firewall Management Center Fmc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Missing authentication gives PR:N/AC:L over the network; description confirms sensitive-file download (C:H) plus disk-exhaustion DoS (A:H), so I add the confidentiality impact the vendor vector omits.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space.
This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeatedly invoking the API. A successful exploit could allow the attacker to download sensitive files that should be restricted and consume disk space so the device could become unresponsive, causing a DoS condition.
Executive ViewAI
Cisco Secure Firewall Management Center (FMC) - the central console that configures and monitors our entire firewall estate - carries an unauthenticated flaw that lets any remote party who can reach its management interface pull restricted files and, through repeated calls, fill the appliance's disk until it stops responding. Because the affected management API performs no authentication checks, an attacker needs no credentials, and the same weakness delivers both data theft and loss of availability across release trains 7.3.0 through 7.7.12 and 10.0.0/10.0.1. Leadership should care because a compromise or outage here can expose firewall configuration and credential material and simultaneously blind or disable perimeter enforcement, and no vendor patch is available today.
No vendor-released patch identified at time of analysis; interim mitigations are network-based. Restrict access to the FMC management plane to trusted administrative segments and jump hosts, since network reachability is the primary exposure limiter; block internet-facing exposure of the management API. Enable logging and alerting on management-API requests and disk utilization to detect repeated unauthenticated calls, and maintain backups/snapshots of FMC configuration to speed recovery from a disk-exhaustion outage. Engage Cisco TAC for a hotfix or fix timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Exploit-DB