CVE-2026-76412

Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.18.5High EPSS percentile36th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether you run Cisco Secure Firewall Management Center and identify its installed software version.
Review all accounts with access and immediately disable unnecessary, shared, or former-staff accounts.
Ask Cisco or your support provider for the fixed software version; no patch or fixed version information is currently available.
Restrict the management website and API to trusted administrator networks while awaiting vendor guidance.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes: To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability.

In plain language

Written by AI from the record

A flaw in Cisco Secure Firewall Management Center can let a logged-in attacker take full control of the device, so small businesses using it should act now.

Authenticated remote privilege escalation to root in Cisco Secure Firewall Management Center through insufficient privilege checks in the remote diagnostics debugger.

If you're affected

Full device takeover
Security policy changes
Network monitoring disruption
Sensitive data exposure

What is it

This is a weakness in a management system used to oversee firewall security. It is like giving someone with a building access badge a way to obtain the master keys, allowing them to change protections or interfere with operations.

Who is affected

This matters to you if you run Cisco Secure Firewall Management Center to manage firewall devices. It is a risk only when an attacker already has a valid account that can access its management website or programming interface.

How urgent is it

A public exploit is available, giving an attacker with a valid account a practical way to attempt takeover. Treat this as urgent: reduce account access and limit management access while you obtain Cisco’s remediation guidance.

What to do — in detail

Confirm deployment by checking your Cisco Secure Firewall Management Center inventory and installed version, then identify every account permitted to use the management interface or REST API. There is no published fixed version or patch information available, so obtain the supported remediation path directly from Cisco or your service provider before scheduling an upgrade.

Until a fix is available, disable unneeded accounts, replace shared administrator accounts with named accounts, revoke access for departed staff, and restrict web-management and REST API access to a dedicated administrator network. If operationally feasible, disable or tightly restrict remote diagnostics access. Review account-privilege changes, newly enabled diagnostics services, unexpected administrator accounts, and management-interface/API activity for signs of misuse.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies.

Technical context

CVE-2026-76412 is rated CVSS 8.5 High (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). The weakness is CWE-264: insufficient privilege validation in the remote diagnostics debugger; an authenticated remote user can invoke remote diagnostics through the web management interface or REST API and elevate privileges to root. A public exploit is available, although CISA KEV does not list this CVE. EPSS is 0.3% at the 25th percentile with a flat trend; this is predictive scoring, not confirmation of in-the-wild exploitation. Exploitation requires valid credentials and a multistage process, reflected in the High attack-complexity rating.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-09-18Record updated
2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems
- Cisco Secure Firewall Management Center (FMC)Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 8.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable