SecurityWeekEduard Kovacs
Cisco patches zero day flaw in Secure FMC after July attacks
Part of the CVE-2026-20316 story · since 29 Jul
Quiet for 6 weekslast report 17 Sep10 articles6 outlets
- Wed 29 Jul, 21:10 UTC. CISA, first report. CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw. Cites a CVE in CISA KEV.
- Wed 29 Jul, 23:10 UTC. SecurityOnline, its first report on the story. Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials. Cites a CVE in CISA KEV.
- Thu 30 Jul, 06:50 UTC. SecurityWeek, its first report on the story. Cisco patches zero day flaw in Secure FMC after July attacks. Cites a CVE in CISA KEV. This article, 3rd of 10.
- Thu 30 Jul, 10:00 UTC. Security Affairs, its first report on the story. CISA warns attackers exploit Cisco firewall flaw CVE-2026-20316. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News, its first report on the story. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading, its first report on the story. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
Cisco has announced patches for a high-severity zero-day vulnerability (CVE-2026-20316) in its Secure Firewall Management Center (FMC), which allows attackers to exploit default credentials to access sensitive data. This vulnerability has been actively exploited since July and can potentially be chained with other FMC vulnerabilities to escalate privileges.
Cisco advises organizations to limit public internet access to the FMC management interface to reduce the attack surface, and has provided indicators of compromise (IoCs) for detection. Additionally, CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging government entities to address it by August 1. Cisco also updated its advisory for another critical FMC vulnerability patched earlier.
How the story developed
Quiet for 6 weekslast report 17 Sep10 articles6 outlets
10 articles from 6 outlets since 29 Jul. Quiet since 17 Sep. This was the 3rd report, 10 hours after the first.
- Wed 29 Jul, 21:10 UTC. CISA, first report. CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw. Cites a CVE in CISA KEV.
- Wed 29 Jul, 23:10 UTC. SecurityOnline, its first report on the story. Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials. Cites a CVE in CISA KEV.
- Thu 30 Jul, 06:50 UTC. SecurityWeek, its first report on the story. Cisco patches zero day flaw in Secure FMC after July attacks. Cites a CVE in CISA KEV. This article, 3rd of 10.
- Thu 30 Jul, 10:00 UTC. Security Affairs, its first report on the story. CISA warns attackers exploit Cisco firewall flaw CVE-2026-20316. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News, its first report on the story. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading, its first report on the story. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 10 articles as a listHide the list
- Wed 29 JulDay 02
- CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw21:10 · CISA · official · First report · CISA alert · Known exploited CVE
- Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials23:10 · SecurityOnline · Known exploited CVE
- Thu 30 JulDay 12
- Cisco patches zero day flaw in Secure FMC after July attacks06:50 · SecurityWeek · Known exploited CVE · This article, 3rd of 10
- CISA warns attackers exploit Cisco firewall flaw CVE-2026-2031610:00 · Security Affairs · Known exploited CVE
Quiet for 6 weeks
Wed 9 SepDay 421- Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access23:28 · SecurityOnline · Picked up again · Known exploited CVE
- Thu 10 SepDay 431
- Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Known exploited CVE
- Fri 11 SepDay 442
- Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware07:48 · The Hacker News · Known exploited CVE
- Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE
Quiet for 3 days
Mon 14 SepDay 471- Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink22:16 · Dark Reading · Picked up again · Known exploited CVE
Quiet for 3 days
Thu 17 SepDay 501- Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation12:30 · SecurityWeek · Picked up again · Known exploited CVE