Cisco Secure Firewall Management Center Fmc
Monthly
Arbitrary file disclosure in Cisco Secure Firewall Management Center (FMC) allows an authenticated, remote attacker holding only a Security Analyst (read-only) account to download arbitrary files from the affected system by sending a crafted HTTPS request to a file download API that fails to sanitize user input. The vulnerability scores CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality impact is high and the scope change indicates the flaw crosses a security boundary between the web application and the underlying appliance filesystem, while integrity and availability are unaffected. The primary limiting factor is the credential requirement - a low-privileged but valid FMC account is mandatory - and there is no indication of active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and no EPSS data was provided, making this a genuine but bounded confidentiality issue rather than a top-tier emergency.
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Security Approver, Access Admin, or Network Admin role to execute arbitrary SQL against the backend database, potentially exfiltrating any data and capturing session credentials of an authenticated Administrator. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity gated only by the required privileged account, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated file disclosure and disk-exhaustion denial of service in Cisco Secure Firewall Management Center (FMC) let a remote attacker pull sensitive files from a critical management API that performs no authentication checks. The vendor assigns CVSS 7.5, while our independent assessment scores it higher at CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H because the same missing-authentication flaw (CWE-306) yields both confidentiality and availability impact: a single unauthenticated call can exfiltrate restricted files, and sustained repeated invocation exhausts disk until the appliance becomes unresponsive. Affected release trains span FMC 7.3.0 through 7.7.12 plus 10.0.0 and 10.0.1 (tracked as EUVD-2026-81126); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary exposure limiter is network reachability to the FMC management plane.
Session-token forgery in the Cisco Secure Firewall Management Center (FMC) ASDM single sign-on handler lets an unauthenticated, remote attacker authenticate as the ASDM administrator user without any credentials or user interaction, and by repeating the forgery keep legitimate administrators locked out of ASDM indefinitely. The flaw stems from improper management of the ASDM SSO token (CWE-1259, improper restriction of security token inheritance), and it affects FMC releases across the 7.0.x through 7.7.x lines as well as 10.0.x per EUVD. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the assessed impact is administrator account takeover and sustained denial of administrative access (CVSS 8.2, A:H, I:L), with the main practical barrier being network reachability to the FMC/ASDM management interface.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar - the least-privileged FMC role rather than an admin account - makes this a high-priority management-plane risk for internet- or broadly reachable deployments. Cisco Secure Firewall Management Center versions across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains are reported as affected.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root on Cisco Secure Firewall Management Center (FMC) Software and its high-availability peer by abusing the sftunnel inter-device management channel to send crafted remote procedure calls that the FMC deserializes insecurely. Because the flaw crosses a security boundary (scope change), a single compromised managed firewall yields full control over the central management platform and its HA partner, giving the issue a disproportionately large blast radius. Exploitation is not unauthenticated: it requires prior administrative access to a managed FTD (PR:H) with no user interaction, and at time of analysis there is no public exploit identified, though the high CVSS base score of 9.1 and the sensitivity of firewall management infrastructure warrant prompt attention.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker who possesses valid user credentials on the FMC - or who can hijack an established sftunnel peer connection - can send a crafted sftunnel command that writes a malicious file to any location on the device, and that file is then executed with root privileges (CVSS 9.9, CWE-862). Authentication is required (CVSS vector PR:L), no user interaction is needed, and the sftunnel path is normally used between FMC and managed firewall devices rather than being exposed to arbitrary internet clients; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.
Arbitrary file disclosure in Cisco Secure Firewall Management Center (FMC) allows an authenticated, remote attacker holding only a Security Analyst (read-only) account to download arbitrary files from the affected system by sending a crafted HTTPS request to a file download API that fails to sanitize user input. The vulnerability scores CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality impact is high and the scope change indicates the flaw crosses a security boundary between the web application and the underlying appliance filesystem, while integrity and availability are unaffected. The primary limiting factor is the credential requirement - a low-privileged but valid FMC account is mandatory - and there is no indication of active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and no EPSS data was provided, making this a genuine but bounded confidentiality issue rather than a top-tier emergency.
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Security Approver, Access Admin, or Network Admin role to execute arbitrary SQL against the backend database, potentially exfiltrating any data and capturing session credentials of an authenticated Administrator. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity gated only by the required privileged account, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated file disclosure and disk-exhaustion denial of service in Cisco Secure Firewall Management Center (FMC) let a remote attacker pull sensitive files from a critical management API that performs no authentication checks. The vendor assigns CVSS 7.5, while our independent assessment scores it higher at CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H because the same missing-authentication flaw (CWE-306) yields both confidentiality and availability impact: a single unauthenticated call can exfiltrate restricted files, and sustained repeated invocation exhausts disk until the appliance becomes unresponsive. Affected release trains span FMC 7.3.0 through 7.7.12 plus 10.0.0 and 10.0.1 (tracked as EUVD-2026-81126); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary exposure limiter is network reachability to the FMC management plane.
Session-token forgery in the Cisco Secure Firewall Management Center (FMC) ASDM single sign-on handler lets an unauthenticated, remote attacker authenticate as the ASDM administrator user without any credentials or user interaction, and by repeating the forgery keep legitimate administrators locked out of ASDM indefinitely. The flaw stems from improper management of the ASDM SSO token (CWE-1259, improper restriction of security token inheritance), and it affects FMC releases across the 7.0.x through 7.7.x lines as well as 10.0.x per EUVD. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the assessed impact is administrator account takeover and sustained denial of administrative access (CVSS 8.2, A:H, I:L), with the main practical barrier being network reachability to the FMC/ASDM management interface.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar - the least-privileged FMC role rather than an admin account - makes this a high-priority management-plane risk for internet- or broadly reachable deployments. Cisco Secure Firewall Management Center versions across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains are reported as affected.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root on Cisco Secure Firewall Management Center (FMC) Software and its high-availability peer by abusing the sftunnel inter-device management channel to send crafted remote procedure calls that the FMC deserializes insecurely. Because the flaw crosses a security boundary (scope change), a single compromised managed firewall yields full control over the central management platform and its HA partner, giving the issue a disproportionately large blast radius. Exploitation is not unauthenticated: it requires prior administrative access to a managed FTD (PR:H) with no user interaction, and at time of analysis there is no public exploit identified, though the high CVSS base score of 9.1 and the sensitivity of firewall management infrastructure warrant prompt attention.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker who possesses valid user credentials on the FMC - or who can hijack an established sftunnel peer connection - can send a crafted sftunnel command that writes a malicious file to any location on the device, and that file is then executed with root privileges (CVSS 9.9, CWE-862). Authentication is required (CVSS vector PR:L), no user interaction is needed, and the sftunnel path is normally used between FMC and managed firewall devices rather than being exposed to arbitrary internet clients; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.