EUVD-2026-80887

A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...

CVE-2026-76420 Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...

CVE-2026-76420 Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...

PT-2026-93975

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Cisco Secure FTD Software affected versions not specified Description An issue exists in the sftunnel inter-device communication protocol during the TLS connection setup. An...

PT-2026-93991

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the sftunnel inter-device communication protocol that allows an authenticated remote attacker to obtain root privileges on a device running the software a...

CVE-2026-20323: Improper Certificate Validation

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager role, which is equivalent to root. This...

CVE-2026-20342: Authorization Bypass Through User-Controlled Key

A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by...

CVE-2026-20340: Deserialization of Untrusted Data

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...

PT-2026-93990

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An authenticated remote attacker can execute arbitrary commands with root privileges due to unsecured deserialization of user-controlled data within the web-management...

PT-2026-93994

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform a SQL injection attack. This occurs due to insufficient validation of...

PT-2026-93979

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Cisco Secure FTD Software affected versions not specified Description An issue exists in the sftunnel inter-device communication protocol. An unauthenticated, adjacent attacker can...

PT-2026-93868

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the internal configuration of the Apache JServ Protocol AJP connector. This is caused by the incorrect initialization of encryption parameters for the AJP...

PT-2026-93993

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An unauthenticated remote attacker can exploit a critical API that lacks authentication. By repeatedly invoking this API, an attacker can download restricted sensitive files...

PT-2026-94001

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software. This flaw results from improper management of th...

CVE-2026-76420: Improper Authorization

A vulnerability in the internal configuration of the Apache JServ Protocol AJP connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector...

PT-2026-93992

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in a specific file download API allows an authenticated remote attacker to download arbitrary files from the system. This occurs because user input is not properly...

PT-2026-94000

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the remote diagnostics debugger of Cisco Secure FMC Software where an error occurs when verifying the privilege level of a user invoking remote diagnostic...

CVE-2026-76412: Undefined Security Weakness

A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An...

CVE-2026-20344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

CVE-2026-20343: Missing Authentication for Critical Function

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...