EUVD-2026-81139
GHSA-f2cp-mvp8-7wp4
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent management-segment access (AV:A) and the sftunnel-down race condition justify AC:H; no auth or interaction (PR:N/UI:N); peer impersonation compromises the managed devices (S:C) at root (C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager role, which is equivalent to root.
This vulnerability is due to improper management of the TLS certificate for the sftunnel management connection. An attacker could exploit this vulnerability by connecting to the sftunnel port using a crafted TLS certificate. A successful exploit could allow the attacker to become a registered sftunnel peer with root access. Note: The attack is successful only if the sftunnel connection is down or the attack can disrupt the sftunnel connection long enough to execute the attack.
AnalysisAI
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent access to the sftunnel inter-device management channel between a Cisco Secure FMC and its managed FTD devices (AV:A) - the attacker must be able to reach the sftunnel port on the same or a reachable management segment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely serious flaw that warrants prioritized patching, though not an automatic emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status for this CVE is not confirmed from the data provided; Cisco has not published an exact fixed version in the supplied sources, so administrators should consult the vendor advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3 for the current fixed-release matrix and apply the recommended upgrade to both FMC and its managed FTD devices, since the sftunnel protocol is implemented on both sides. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco FMC and FTD deployments, confirm whether the sftunnel management channel is reachable from any adjacent network segment, and implement network-level restrictions so that sftunnel traffic (TCP 8305) is permitted only between known peer devices on a dedicated, isolated out-of-band management network; increase monitoring and alerting on sftunnel reconnection events and unexpected peer registrations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today