SecurityOnlineDo Son
Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials
Part of the CVE-2026-20316 story · since 29 Jul
Quiet for 6 weekslast report 17 Sep10 articles6 outlets
- Wed 29 Jul, 21:10 UTC. CISA, first report. CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw. Cites a CVE in CISA KEV.
- Wed 29 Jul, 23:10 UTC. SecurityOnline, its first report on the story. Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials. Cites a CVE in CISA KEV. This article, 2nd of 10.
- Thu 30 Jul, 06:50 UTC. SecurityWeek, its first report on the story. Cisco patches zero day flaw in Secure FMC after July attacks. Cites a CVE in CISA KEV.
- Thu 30 Jul, 10:00 UTC. Security Affairs, its first report on the story. CISA warns attackers exploit Cisco firewall flaw CVE-2026-20316. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News, its first report on the story. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading, its first report on the story. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
Cisco has issued a warning about a vulnerability in its Firewall Management Center (FMC), identified as CVE-2026-20316, which is currently under active attack. This vulnerability allows remote attackers to log in using hidden static credentials, exposing sensitive configuration and monitoring data. Key details include:
- **CVE ID:** CVE-2026-20316
- **CVSS Score:** 5.3 (Medium)
- **Affected versions:** 7.0.0, 7.0.1, 7.0.2, 7.2.0, among others
- **Impact:** Exploitation could lead to privilege escalation.
- **Status:** Actively exploited in the wild; added to CISA's Known Exploited Vulnerabilities catalog.
To mitigate this risk, Cisco advises immediate patching as there are no workarounds available. Users are encouraged to check for a hotfix applicable to their version.
How the story developed
Quiet for 6 weekslast report 17 Sep10 articles6 outlets
10 articles from 6 outlets since 29 Jul. Quiet since 17 Sep. This was the 2nd report, 2 hours after the first.
- Wed 29 Jul, 21:10 UTC. CISA, first report. CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw. Cites a CVE in CISA KEV.
- Wed 29 Jul, 23:10 UTC. SecurityOnline, its first report on the story. Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials. Cites a CVE in CISA KEV. This article, 2nd of 10.
- Thu 30 Jul, 06:50 UTC. SecurityWeek, its first report on the story. Cisco patches zero day flaw in Secure FMC after July attacks. Cites a CVE in CISA KEV.
- Thu 30 Jul, 10:00 UTC. Security Affairs, its first report on the story. CISA warns attackers exploit Cisco firewall flaw CVE-2026-20316. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News, its first report on the story. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading, its first report on the story. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 10 articles as a listHide the list
- Wed 29 JulDay 02
- CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw21:10 · CISA · official · First report · CISA alert · Known exploited CVE
- Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials23:10 · SecurityOnline · Known exploited CVE · This article, 2nd of 10
- Thu 30 JulDay 12
- Cisco patches zero day flaw in Secure FMC after July attacks06:50 · SecurityWeek · Known exploited CVE
- CISA warns attackers exploit Cisco firewall flaw CVE-2026-2031610:00 · Security Affairs · Known exploited CVE
Quiet for 6 weeks
Wed 9 SepDay 421- Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access23:28 · SecurityOnline · Picked up again · Known exploited CVE
- Thu 10 SepDay 431
- Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Known exploited CVE
- Fri 11 SepDay 442
- Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware07:48 · The Hacker News · Known exploited CVE
- Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE
Quiet for 3 days
Mon 14 SepDay 471- Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink22:16 · Dark Reading · Picked up again · Known exploited CVE
Quiet for 3 days
Thu 17 SepDay 501- Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation12:30 · SecurityWeek · Picked up again · Known exploited CVE