CVE-2026-76413 Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability
Unauthenticated attackers can forge SSO tokens to log in as administrator, potentially locking out legitimate users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76413?
CVE-2026-76413 is a high-severity authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An attacker could exploit this vulnerability by performing session token forgery techniques. A successful exploit could allow the attacker to log in as the administrator user and, by repeating this action, keep legitimate administrators locked out of the ASDM indefinitely.
Weakness: CWE-1259
Which versions are affected by CVE-2026-76413?
How do I fix CVE-2026-76413?
No fix has been published for CVE-2026-76413 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76413 being exploited?
There is no known exploitation of CVE-2026-76413 in the wild and no public exploit code.
Sources
Also known as GHSA-g9vq-7qf2-jm65.