CVE-2026-76420

Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.0Critical EPSS percentile29th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether you run Cisco Secure Firewall Management Center and whether any sftunnel connection to Cisco Secure Firewall Threat Defense is down.
Ask Cisco or your support provider for the published fixed version; no fixed version is available in the current advisories.
Until Cisco provides a fix, restore and maintain sftunnel connections, restrict access to the management appliance, and investigate unexpected management API activity.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector at boot time. An attacker could exploit this vulnerability by sending crafted packets to the AJP connector. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs on the affected device. Note: This vulnerability can be exploited only if the valid sftunnel connection between Cisco Secure FMC Software and Cisco Secure FTD Software is down.

In plain language

Written by AI from the record

Businesses running Cisco Secure Firewall Management Center should treat this as an immediate concern: a public attack is available and no fix information has been published.

Unauthenticated remote root command execution is possible through crafted Apache JServ Protocol connector traffic because encryption parameters are initialized incorrectly at boot, allowing peer-device impersonation when the sftunnel connection is down.

If you're affected

Full management system takeover
Firewall policy tampering
Network access disruption
Sensitive configuration exposure
Service outage risk

What is it

This flaw can let an outsider pretend to be a trusted firewall device and take control of the firewall management system. It is like someone using a convincing forged staff badge to enter the control room and change every building access rule.

Who is affected

This matters to you if you run Cisco Secure Firewall Management Center to manage your firewalls. It is only a risk when the valid sftunnel connection between it and Cisco Secure Firewall Threat Defense is down.

How urgent is it

A public exploit is available for this critical flaw, so treat exposed affected systems as an urgent incident-prevention priority. Although it is not listed in CISA’s known-exploited catalog, there is no published fix information, making temporary protections especially important.

What to do — in detail

Confirm the appliance is Cisco Secure Firewall Management Center and identify every connection to Cisco Secure Firewall Threat Defense. Prioritize any appliance whose valid sftunnel connection is down, because that is the stated exploitation condition.

No fixed release or supported-version branch has been provided in the available patch findings, so do not assume a software update resolves this issue. Obtain Cisco’s current remediation guidance from your support provider, then schedule the vendor-provided upgrade as soon as an exact fixed version is published.

If patching is delayed, restore and keep the valid sftunnel connection operational, restrict network access to the management appliance to only required trusted systems, and review management API and appliance logs for unexpected commands, configuration changes, or connection activity. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVSS 3.1 score: 9.0 (Critical), vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The issue is CWE-285 and stems from incorrect boot-time initialization of AJP connector encryption parameters; crafted AJP packets can impersonate a peer and yield root command execution plus full FMC REST API control. Exploitation requires the valid FMC-to-FTD sftunnel connection to be down. Public exploit code is available, but CISA KEV does not list this CVE and the findings do not confirm exploitation in the wild. EPSS is 0.4% (31st percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS29th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 29th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 1 day, from the signal feeds we watch.

2026-09-17Record updatedrecord updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems
- Cisco Secure Firewall Management Center (FMC)Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 9.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable