Cisco
CVE-2026-76413: Cisco Secure FMC Single Sign-On Token Forgery Account Vulnerability
Forged ASDM single sign-on tokens can let unauthenticated attackers log in as administrator and sustain administrator lockouts. Update FMC through the CVE-specific path and preserve token, session and lockout evidence.
CVE-2026-20333: Cisco ASA, FTD, and FMC hardening: Incorrect Comparison Vulnerabilities
Incorrect security comparisons are grouped in this ASA, FTD and FMC hardening entry. The compared values and a specific traffic bypass remain undisclosed; use the product-specific release guidance and preserve its ASA hotfix exceptions.
CVE-2026-76420: Cisco Secure FMC Software Peer Impersonation Vulnerability
When the legitimate FMC-to-FTD tunnel is down, unauthenticated peer impersonation can lead to root commands and REST API control. Preserve outage and peer activity, then apply the fix; restored connectivity does not exclude earlier compromise.
CVE-2026-20334: Cisco ASA, FTD, and FMC hardening: Coding Standards Vulnerabilities
Cisco's coding-standard hardening entry for ASA, FTD and FMC discloses no specific defect or exploit outcome. Use the product-and-release update guidance, including ASA hotfix exceptions, instead of inferring protection from build numbering alone.
CVE-2026-76423: Cisco ISE REST API Authentication Bypass Vulnerability
Unauthenticated REST API requests can read or modify ISE and ISE-PIC configuration and identity data with administrative privileges. Inventory both products, apply the CVE-specific fix, and review API exposure and activity.
CVE-2026-20335: Cisco ASA, FTD, and FMC hardening: Incorrect Calculation Vulnerabilities
Incorrect calculations can lead to unsafe security or resource decisions in Cisco ASA, FTD and FMC. Match the installed platform and release to the hardening guidance; the umbrella Critical rating is not a CVE-specific severity assignment.
CVE-2026-76424: Cisco ISE Arbitrary File Access Vulnerability
An ISE administrator can use crafted REST API paths to place files and potentially execute root commands. Apply the ISE-specific fix and investigate files already uploaded or copied; a successful update does not establish their removal.
CVE-2026-20336: Cisco ASA, FTD, and FMC hardening: Resource Lifetime Management Vulnerabilities
Cisco groups resource-lifetime flaws across ASA, FTD and FMC without describing an individual attack path. The article separates conflicting source scores and affected-hotfix guidance from an exploitation footnote belonging to another category.
CVE-2026-20340: Cisco Secure FMC Software Deserialization Arbitrary Root Command Execution Vulnerability
Even a read-only Security Analyst account can submit an FMC web-management payload that executes as root. Review those accounts and install the CVE-specific fixed release; a read-only application role does not remove this execution risk.
CVE-2026-20341: Cisco Secure FMC Software sftunnel Deserialization Root Command Execution Vulnerability
Privileged access on a managed FTD device can enable sftunnel deserialization attacks against FMC and its high-availability peer. Review managed-device trust and apply the specific fix, retaining Cisco's differing descriptions of the required privilege.