Cisco Secure Client Secure Firewall Posture module: local privilege escalation via crafted IPC messages (CVE-2026-76462)
Severity: high · Patch status: patched · Since 2026-10-21 · CVE-2026-76462
Cisco published a High-rated advisory for a privilege escalation vulnerability (CVE-2026-76462, CWE-20) in the IPC channel of the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux. Insufficient validation of user-supplied input lets an authenticated local attacker send crafted IPC messages to a local socket and perform limited file writes with SYSTEM or root privileges; on macOS and Linux this can yield full root, which is why Cisco rated it High despite the 5.5 CVSS. No workarounds exist and no public exploitation is known. Fixed in Cisco Secure Client 5.1.20.333; earlier releases are vulnerable. Bug ID CSCwu48192.
What to do
- Upgrade Cisco Secure Client to 5.1.20.333 or later on all endpoints running the Secure Firewall Posture module
- Prioritise macOS and Linux hosts, where exploitation yields full root privileges
- Restrict local access to devices running the Posture module until patched
- Check with Cisco TAC for fixed software if lacking a valid service contract
Fixed versions
Sources
All live incidents on Threat Watch
