CVE-2026-76420

CVE-2026-76420 is an improper authorization flaw (CWE-285) in the internal configuration of the Apache JServ Protocol (AJP) connector in Cisco Secure FMC Software, caused by incorrect initialization of the connector's encryption parameters at boot time. An unauthenticated remote attacker can trigger it by sending crafted packets to the AJP connector, but only while the valid sftunnel connection between the FMC and its managed Cisco Secure FTD devices is down — allowing the attacker to impersonate a peer device. A successful exploit yields command execution as root and full control of the FMC REST APIs, giving complete compromise of the management center and, by extension, the firewall policies it pushes. Any organization running Cisco Secure FMC paired with Secure FTD devices is affected during a tunnel outage; no exploitation in the wild, public PoC, or KEV listing is currently known.

What to do: Upgrade Cisco Secure FMC to the fixed release per Cisco's advisory (fixed versions not listed in this data). Until patched, keep the FMC–FTD sftunnel connection healthy and restore any tunnel outages immediately, restrict access to the FMC management interface (including the AJP port, typically TCP 8009) to trusted management networks, and alert on FTD disconnect/tunnel-down events as elevated-risk windows.