CVE-2026-76413

Cisco Secure Firewall Management Center (FMC) Software contains a flaw in the Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler, caused by improper management of the ASDM SSO token (CWE-1259). An unauthenticated, remote attacker can exploit it by performing session token forgery techniques against the ASDM SSO login mechanism. A successful attack lets the attacker log in as the ASDM administrator without any credentials, and by repeatedly forging tokens they can keep legitimate administrators locked out of ASDM indefinitely, consistent with the high-availability impact reflected in the 8.2 CVSS score. Any organization running Cisco Secure FMC with ASDM SSO enabled is exposed, since no user interaction or prior access is required. As of now there is no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV.

What to do: Upgrade Cisco ASDM and Cisco Secure FMC to the fixed releases identified in Cisco's advisory for CVE-2026-76413 (no fixed version numbers were provided in this data). Until patched, restrict ASDM and FMC management interfaces to trusted administrative networks or VPN access via access control lists, and monitor for unexpected ASDM administrator logins or repeated administrator lockouts, which could indicate token-forgery attempts.