CVE-2026-76412 Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability
An authenticated attacker can exploit a remote diagnostics debugger flaw to elevate privileges to root on Cisco Secure Firewall Management Center.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76412?
CVE-2026-76412 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC), published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes: To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability.
Weakness: CWE-264
Which versions are affected by CVE-2026-76412?
How do I fix CVE-2026-76412?
No fix has been published for CVE-2026-76412 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76412 being exploited?
There is no known exploitation of CVE-2026-76412 in the wild and no public exploit code.
Sources
Also known as GHSA-cxq7-wwr3-xj8v.