OTPulse

Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Vulnerabilities

Plan PatchCVSS 8.6cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3Sep 16, 2026
CiscoEnergyManufacturing
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) software could allow an unauthenticated attacker to bypass sftunnel authentication or trigger a denial of service attack. Affected products include Firepower 2100/1000/4100/9000 Series, ASA 5500-X firewalls, 3000 Series Industrial Security Appliances, Secure Firewall 1200/3100/4200/6100/200 Series, Secure Firewall Management Center appliances, and Secure Firewall Threat Defense Virtual. Cisco has released software updates that address these vulnerabilities.

What this means
What could happen
An unauthenticated attacker on the network can bypass authentication to the sftunnel service or cause it to become unavailable, potentially disrupting secure communication between your firewall appliances and management center.
Who's at risk
Energy and manufacturing facilities using Cisco Secure Firewall appliances including Firepower series (2100, 1000, 4100, 9000), ASA 5500-X firewalls, 3000 Series Industrial Security Appliances (ISA), Secure Firewall series (1200, 3100, 4200, 6100, 200, Virtual), and Secure Firewall Management Center appliances are at risk.
How it could be exploited
An attacker with network access to the sftunnel service (typically on port 8305) can send crafted requests to bypass authentication checks or trigger a denial of service condition, disconnecting managed firewalls from the Secure Firewall Management Center.
Prerequisites
  • Network access to sftunnel service port (default port 8305)
  • No authentication credentials required
remotely exploitableno authentication requiredlow complexityhigh CVSS score (8.6)
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (13)
13 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Secure Firewall Threat Defense VirtualAll versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/1
HARDENINGRestrict network access to sftunnel service ports on all Secure Firewall appliances to only authorized management networks
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

3000 Series Industrial Security Appliances (ISA)
HOTFIXUpdate Secure Firewall Threat Defense software on all appliances (Firepower series, ASA 5500-X, 3000 Series ISA, Secure Firewall 1200/3100/4200/6100/200 Series) to the patched version released by Cisco on September 16, 2026
All products
HOTFIXUpdate Secure Firewall Management Center software to the patched version released by Cisco on September 16, 2026
HOTFIXIf running Secure Firewall Management Center or Threat Defense Virtual, prioritize patching these systems first as they provide centralized management
View full vendor advisory
API: /api/v1/advisories/0ab47d52-068c-4b3a-ab97-bd66a989240f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.