CVE-2026-76420: Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability
A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector at boot time. An attacker could exploit this vulnerability by sending crafted packets to the AJP connector. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs on the affected device. Note: This vulnerability can be exploited only if the valid sftunnel connection between Cisco Secure FMC Software and Cisco Secure FTD Software is down.
Affected Software
Event History
Frequently Asked Questions
When is an affected FMC device exposed to exploitation?
Exploitation is possible only when the valid sftunnel connection between Cisco Secure FMC Software and Cisco Secure FTD Software is down. The attacker must be able to send crafted packets to the FMC AJP connector during that condition.
Does exploitation require credentials or user interaction?
No. The vulnerability is described as remotely exploitable by an unauthenticated attacker, with no user interaction required.
What is the potential impact of a successful attack?
A successful exploit could let an attacker execute commands as root and obtain full control of the affected device's FMC REST APIs.