Cisco Secure Firewall & SD-WAN Flaws: One Scores a Perfect CVSS 10.0
What happened
Cisco published advisories covering several serious flaws in its security and networking products:
- CVE-2026-76418 — a denial-of-service flaw in the ASA/FTD SSL VPN (CVSS 8.6) that can knock remote-access VPN offline.
- CVE-2026-20079 — an authentication bypass in Secure Firewall Management Center (FMC) rated a maximum CVSS 10.0.
- CVE-2026-76504 — an authentication bypass in Catalyst SD-WAN Manager.
- Patch to fixed releases for ASA/FTD, Secure FMC, and Catalyst SD-WAN Manager.
- Never expose management interfaces to the internet. FMC and SD-WAN Manager belong on a dedicated, tightly controlled management network.
- Enforce MFA and strong admin segmentation so a single bypass does not equal total control.
- Audit firewall policy changes and alert on unexpected modifications — a quiet rule change is a classic sign of a compromised management plane.
Why it matters
The FMC bug is the one that should keep you up at night. Secure FMC is the management plane — it controls the policy for your entire fleet of firewalls. An authentication bypass there means an attacker could potentially manage your firewalls *as if they were an administrator*, rewriting rules, opening paths, and disabling protections across many devices at once. That is why it earned a perfect 10.0.
The SD-WAN Manager bypass is similar in spirit: compromise the controller, and you influence the whole overlay network.
How to defend
What it means for you
If you are studying for networking and security certifications, note the hierarchy of risk: a DoS on the data plane is painful, but an auth bypass on the management plane is catastrophic. Protecting the systems that *manage* your security controls is just as important as the controls themselves — a core theme across our networking and firewall courses.