OTPulse

Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability

MonitorCVSS 5.5cisco-sa-sec-client-priv-esc-muF8eZdmOct 21, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the Secure Firewall Posture module of Cisco Secure Client allows an authenticated local attacker to escalate privileges on Windows, macOS, and Linux. The flaw stems from insufficient validation of messages sent to the module's interprocess communication (IPC) channel. An attacker could send crafted IPC messages to write files with SYSTEM or root privileges. On macOS and Linux, this can lead to full root access.

What this means
What could happen
A local user with login access to a computer running Cisco Secure Client could escalate their privileges to SYSTEM (Windows) or root (macOS/Linux), potentially gaining full control of that device and any connected networks or systems.
Who's at risk
IT staff and end users whose computers run Cisco Secure Client with the Secure Firewall Posture module enabled. This includes remote workers on Windows, macOS, and Linux endpoints that use Cisco Secure Client for VPN or security policy enforcement. Organizations deploying Secure Client for compliance or remote access should inventory affected systems.
How it could be exploited
An attacker with local login credentials sends specially crafted messages to the Secure Firewall Posture module's local communication channel (IPC socket). If successful, these messages allow the attacker to write files with elevated SYSTEM or root privileges, leading to privilege escalation. On macOS and Linux, this can result in full root compromise.
Prerequisites
  • Local login access to the device running Cisco Secure Client
  • Cisco Secure Client Secure Firewall Posture module version 4.10.00093 through 5.1.9.113 installed
local attack only (not remotely exploitable)requires local login credentialsaffects security policy enforcement on endpointsmacOS and Linux systems can achieve full root privileges
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (1)
ProductAffected VersionsFix Status
Cisco Secure Client Secure Firewall Posture Module4.10.00093 through 5.1.9.113Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco Secure Client Secure Firewall Posture module to version 5.1.10.0 or later
View full vendor advisory
API: /api/v1/advisories/e77d39d2-b3d1-4245-b849-3ae179f1811e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.