EUVD-2026-81138
GHSA-cxq7-wwr3-xj8v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to FMC web UI or REST API
-
DeliveryInvoke remote diagnostics debugger
-
ExploitBypass flawed privilege-level check
-
ExecutionEnable debugger and grant elevated privileges
-
ImpactEscalate to root on appliance
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission and access control
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid authenticated user credentials on the FMC device (PR:L) and access to either the web-based management interface or the REST API. The specific target feature is the remote diagnostics debugger service, whose privilege-level check is faulty (CWE-264). Exploitation is limited by a multistage process (Cisco-assigned AC:H), so it is not a single-shot exploit, and the attacker must already possess an account - there is no unauthenticated path. Affected releases are FMC 7.7.0/7.7.10/7.7.10.1/7.7.11/7.7.12 and 10.0.0/10.0.1 per EUVD; no non-default configuration is otherwise required. |
| Impact | This is a genuine but access-gated privilege-escalation flaw, not a fire-drill. The CVSS 8.5 (High) rests on S:C and C/I/A:H because a successful exploit reaches root on Cisco Secure FMC, but three signals temper real-world urgency: PR:L requires the attacker to already hold valid credentials, and AC:H reflects Cisco's own note that full exploitation is a multistage process. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - targeted post-authentication abuse is plausible but there is no evidence of mass or automated exploitation. The CVSS vector (AV:N/PR:L) and the description are internally consistent: authenticated remote access via web UI or REST API, which matches the S:C root-escalation claim. Priority is real for any FMC where low-privilege accounts are broadly issued, but the credential requirement plus attack complexity keeps this below the unauthenticated-RCE tier. Missing EPSS/KEV data means widespread-exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | A low-privileged but authenticated FMC user logs into the web management interface or REST API, then abuses the remote diagnostics debugger - whose privilege-level check is flawed - to enable the debugger service and walk through the multistage process that grants elevated privileges, ultimately reaching root on the appliance. No public exploit code is identified, and Cisco notes the chain requires several stages, so this is a deliberate insider or credential-theft scenario rather than opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
RemediationAI
No vendor-released patch version is identified in the available data for CVE-2026-76412; the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc2-multivulns-HXgcqRG is the authoritative source for fixed software and should be checked for the corrected release for each 7.7.x and 10.0.x deployment before upgrading. Until a fixed build can be applied, restrict access to the FMC management interface and REST API so that only trusted administrative networks or jump hosts can reach them - this does not remove the flaw but denies the reachability the vector (AV:N) assumes, at the cost of tightening operational access for legitimate admins. Because the debugger is the abused feature, consider disabling or blocking use of the remote diagnostics debugger service on production FMC appliances, accepting the trade-off that Cisco TAC-driven and self-service troubleshooting becomes unavailable or must be temporarily re-enabled under supervision. Audit and minimize accounts with any privilege that can invoke remote diagnostics, remove unnecessary low-privileged accounts on the appliance (the vector requires PR:L, so reducing the account pool directly reduces exposure), and enforce strong authentication on those accounts. Finally, monitor FMC audit and diagnostic logs for unexpected remote diagnostics debugger start events or privilege transitions from a user context to root, and treat such events as likely exploitation attempts; note that none of these compensating controls is a substitute for installing the vendor fix once its version is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Firewall Management Center is the centralized management appliance for Cisco Secure Firewall (Firepower) deployments, exposing an administrative web UI and a REST API that are used for policy, device, and diagnostic management. The vulnerable component is the remote diagnostics debugger, a service intended to be started only by sufficiently privileged operators so that Cisco TAC or administrators can collect deep troubleshooting data from the appliance. The root cause is classified as CWE-264 (Permissions, Privileges, and Access Controls): the routine that validates the privilege level of the user requesting remote diagnostics is implemented incorrectly, so the check does not properly bind the caller's role to the privilege required to start the debugger. When a user with only low-level credentials invokes remote diagnostics through the management UI or REST API, the debugger service is enabled in a context that carries root-level authority, and the caller inherits that authority. The CPE string cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc) identifies the affected platform, and the CVSS vector's Scope:Changed (S:C) plus C:H/I:H/A:H reflects that the escalation escapes the user's intended security boundary and yields full control of the appliance; the High Attack Complexity reflects the multistage nature of the request flow rather than any requirement for special configuration, since no non-default setting is needed beyond a valid account.
Know when Cisco Secure Firewall Management Center Fmc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated remote access over web UI/REST API gives AV:N/PR:L; the multistage exploit justifies AC:H; escalation from a low-priv context to root crosses a security boundary (S:C) with full C/I/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service.
This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes:
To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability.
Executive ViewAI
Cisco Secure Firewall Management Center (FMC), the console that defines and enforces network security policy across an organization's managed firewall estate, contains a privilege-escalation flaw (CVE-2026-76412) that lets an already-authorized low-privilege user obtain root-level control of the appliance. Because FMC sets the rules enforced by the firewalls it governs, a compromise at this layer can translate into unauthorized changes to enterprise-wide network segmentation and inspection - and no vendor-released patch is identified at time of analysis. The practical exposure is not the open internet but the population holding legitimate management or API credentials, including shared accounts, contractors, and help-desk personnel, so identity hygiene and administrative network isolation are the primary levers leadership controls today.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict FMC web management interface and REST API reachability to a dedicated administrative network or jump host; remove or downgrade all accounts that do not require remote diagnostics privileges; enforce MFA and unique named accounts for administrators; disable dormant API integrations and service accounts; log and alert on debugger-service enablement and privilege changes; monitor Cisco's advisory for a fixed release or hotfix and apply it as soon as it is available. Note that the issue is an authenticated, remote privilege escalation requiring a valid low-privileged account and a multi-stage exploitation sequence; no public exploit code has been identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Exploit-DB