CVE-2026-76412

CVE-2026-76412 is a privilege-escalation flaw (CWE-264) in the remote diagnostics debugger of Cisco Secure FMC (Firewall Management Center) Software, caused by an error when checking the privilege level of a user invoking remote diagnostics. An attacker who holds valid credentials on the device—no matter how low-privileged—can authenticate via the web-based management interface or the REST API and use the remote diagnostics debugger to enable the service and grant elevated privileges. A successful exploit elevates the attacker to root on the FMC, the central management platform for Cisco Secure Firewalls, giving full control over firewall management (scope-changing, with high confidentiality, integrity, and availability impact). Any organization running Cisco Secure FMC with user accounts is potentially affected, though attack complexity is high because exploitation requires valid credentials and a multistage process. No public proof-of-concept is known, exploitation has not been observed in the wild, and the flaw is not on the CISA KEV list.

What to do: Upgrade FMC to the fixed release specified in Cisco's security advisory for CVE-2026-76412 (exact version numbers are not provided in this dataset). Until patched, restrict access to the FMC web-based management interface and REST API to trusted management networks or a dedicated management interface, audit and remove unnecessary local user accounts, and monitor device logs for enabling or use of the remote diagnostics debugger service.