CVE-2026-76413

Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.18.2High EPSS percentile37th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your organization runs Cisco Secure Firewall Management Center and uses Cisco ASDM single sign-on.
Restrict access to the management interface to trusted administrator networks while you investigate.
Ask Cisco or your support provider for the fixed release; no patch or fixed version information is currently available.
Review management-interface logins for unexpected administrator sessions and investigate any unexplained lockouts.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An attacker could exploit this vulnerability by performing session token forgery techniques. A successful exploit could allow the attacker to log in as the administrator user and, by repeating this action, keep legitimate administrators locked out of the ASDM indefinitely.

In plain language

Written by AI from the record

A public exploit can let outsiders impersonate an administrator in Cisco Secure Firewall Management Center, so businesses that run it should treat this as urgent.

Unauthenticated remote administrator impersonation through forged Cisco ASDM single sign-on tokens in Cisco Secure Firewall Management Center Software.

If you're affected

Administrator account takeover
Firewall-management lockout
Security policy disruption
Operational disruption

What is it

This is a flaw in the sign-on process used to reach the firewall management system. It is like someone being able to make a convincing counterfeit master key: they can enter as an administrator and repeatedly prevent the real administrators from getting back in.

Who is affected

This matters to you if you run Cisco Secure Firewall Management Center and manage it through Cisco ASDM single sign-on. An attacker does not need an existing login or a person to click anything; the risk applies when the affected management service is reachable by the attacker.

How urgent is it

A public exploit is available for an attack that can impersonate an administrator and lock legitimate administrators out indefinitely. Treat this as a red-priority issue: limit management access now and obtain Cisco's remediation guidance as soon as possible.

What to do — in detail

Confirm whether Cisco Secure Firewall Management Center is deployed and whether Cisco ASDM SSO is enabled on its management interface. Determine which networks can reach that interface, including any remote-administration paths.

No vendor fixed version or patch information is available in the supplied findings, so there is no supported target release to provide. Contact Cisco support or the product vendor for the affected-release list, mitigation guidance, and upgrade path before making version changes.

If patching is delayed, restrict the management interface to a dedicated, trusted administrator network and remove unnecessary remote exposure. Review authentication and management logs for unexpected Cisco ASDM administrator sessions, repeated session creation, and legitimate administrator lockouts; preserve relevant logs for investigation. CVE-2026-76413 is not listed in CISA KEV, so no CISA remediation due date applies.

Technical context

CVSS 3.1: 8.2 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). The supplied description attributes the issue to improper management of Cisco ASDM SSO tokens, enabling session-token forgery and unauthenticated remote login as the Cisco ASDM administrator user; repeated exploitation can sustain administrator lockout. A public exploit is available. CISA KEV does not list this CVE. EPSS is 0.3% (25th percentile) with a flat trend; this is a predicted likelihood, not evidence of exploitation in the wild. CWE-1259 is assigned.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS37th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 37th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 2 days, from the signal feeds we watch.

2026-09-18Record updated
2026-09-17Record updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Secure Firewall Management Center (FMC)Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Scored 8.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity LowData modification is possible but limited in scope or consequence
Availability HighTotal denial of service — the component is completely unavailable