SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76420

CRITICAL(9.0)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score33/100 — MITTEL
  • CVSS 9 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector at boot time. An attacker could exploit this vulnerability by sending crafted packets to the AJP connector. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs on the affected device. Note: This vulnerability can be exploited only if the valid sftunnel connection between Cisco Secure FMC Software and Cisco Secure FTD Software is down.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "java" or FileName =~ "apache"
| where ProcessCommandLine contains "AJP" and ProcessCommandLine contains "connector"
| where InitiatingProcessCommandLine contains "boot" or InitiatingProcessFileName contains "boot"
| where ProcessCommandLine contains "encryption" and ProcessCommandLine contains "parameters"
| where ProcessCommandLine contains "incorrect initialization" or ProcessCommandLine contains "vulnerable"

Splunk SPL

(sourcetype=cisco_fmc OR sourcetype=apache_access OR sourcetype=apache_error)
(AJP AND connector AND (boot OR init) AND encryption AND parameters AND ("incorrect initialization" OR vulnerable))
| table _time, host, source, sourcetype, message

Sigma

title: Cisco FMC AJP Connector Vulnerability
id: 76420-cisco-fmc-ajp-connector-vulnerability
status: experimental
description: Detects potential exploitation attempts against CVE-2026-76420 in Cisco Secure FMC Software by monitoring AJP connector activity related to encryption parameter initialization.
author: SecBoard
date: 2026/09/16
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: ['/java', '/apache']
    CommandLine|contains: 
      - 'AJP'
      - 'connector'
      - 'encryption'
      - 'parameters'
    CommandLine|contains:
      - 'boot'
      - 'incorrect initialization'
      - 'vulnerable'
  condition: selection
level: high

Elastic ES|QL

from logs-system.*
| where process.name in ("java", "apache")
| where process.command_line : "AJP" and process.command_line : "connector"
| where process.command_line : "boot" or process.parent.command_line : "boot"
| where process.command_line : "encryption" and process.command_line : "parameters"
| where process.command_line : "incorrect initialization" or process.command_line : "vulnerable"
| select @timestamp, host.name, process.name, process.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen