OTPulse

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

Plan PatchCVSS 9.9cisco-sa-hardening-asaftdfmc-uvpPROhNSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Cisco has discovered multiple internally-identified vulnerabilities in Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software. These vulnerabilities, grouped by their underlying weakness classes (CWE), allow a user with valid low-privilege credentials to escalate privileges and gain administrative control. Two related vulnerabilities are known to be actively exploited in the wild (see separate advisories: Cisco Secure Firewall Management Center Static Credential Vulnerability and Cisco Secure Firewall Management Center Authentication Bypass Vulnerability). Affected versions include 9.9.2.9 through 10.0.0. No workarounds are available; patched versions were released in September 2026.

What this means
What could happen
An attacker with low-level credentials (like an engineer or junior technician) could gain complete control over your firewall, potentially intercepting, modifying, or blocking all network traffic entering and leaving your facility. This could disrupt communications, allow data theft, or prevent critical network services from reaching your OT environment.
Who's at risk
All organizations running Cisco Secure Firewall ASA, Threat Defense (FTD), or Management Center (FMC) software are affected, especially utilities and water authorities that rely on these devices to protect critical OT networks. This affects perimeter firewalls and any centralized firewall management platforms.
How it could be exploited
An attacker authenticates to the firewall management interface with low-privilege credentials (user account), then exploits one or more hardening vulnerabilities in the ASA, FTD, or FMC software to escalate privileges and execute arbitrary commands with administrative access. No special tools or complex attack steps are required beyond initial credential access.
Prerequisites
  • Valid user-level credentials (engineering workstation account or lower) for firewall management interface
  • Network access to the firewall's management interface (typically restricted to admin networks, but included in scope if compromised)
  • Target must be running affected firmware versions (9.9.2.9 through 10.0.0)
remotely exploitablelow complexityrequires only low-privilege credentialsaffects security-critical infrastructure (firewall)multiple vulnerabilities grouped togetherhigh CVSS score (9.9)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 202610.0.0 through 9.9.2.9Fix available
BaseAll versionsFix available
Remediation & Mitigation
0/5
Do now
0/2
Base
HARDENINGRestrict management interface access to firewall and FMC to a small whitelist of trusted administrative networks only, using network-based access controls
All products
HARDENINGEnforce strong, unique passwords for all user accounts with firewall management access; review and remove unnecessary user accounts
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco Secure Firewall ASA software to a patched version released in September 2026 or later
HOTFIXUpdate Cisco Secure Firewall Threat Defense (FTD) software to a patched version released in September 2026 or later
HOTFIXUpdate Cisco Secure Firewall Management Center (FMC) software to a patched version released in September 2026 or later
View full vendor advisory
API: /api/v1/advisories/d79824a0-fcee-489f-9f01-a14c79e76d22

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.