Quick answers
- Is CVE-2026-76412 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76412 being exploited in the wild.
- How severe is CVE-2026-76412?
- High severity, with a CVSS score of 8.5, published 16 September 2026.
- Which products and versions are affected?
- Cisco Secure Firewall Management Center.
- Is there a fix for CVE-2026-76412?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76412 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-76412?
- Check whether you run Cisco Secure Firewall Management Center. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-76412 is a privilege escalation vulnerability caused by improper privilege-level validation in the remote diagnostics debugger of Cisco Secure FMC. The vulnerability exists in the debugger's privilege checking logic when users invoke remote diagnostics functions. An authenticated remote attacker can exploit this by sending requests through the web-based management interface or REST API to enable the remote diagnostics debugger and grant themselves elevated privileges, ultimately achieving root-level access. The attack requires valid user credentials on the device and involves a multistage process, resulting in a high attack complexity rating. Cisco has released software updates to address this vulnerability; no workarounds are available.
Affected products
- Cisco Secure Firewall Management Center
Timeline
- 2026-09-16: disclosed