CVE-2026-20316
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-08-01.
8 articles across 5 outlets · first covered Jul 29, 2026 · latest Sep 11, 2026
Associated threat actors
Coverage timeline
-
Cisco Firewall Flaws Exploited to Deploy Qilin Ransomwaresecurityaffairs.com · Sep 11, 2026
-
Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomwarethehackernews.com · Sep 11, 2026
-
Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomwarewww.securityweek.com · Sep 10, 2026
-
Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Accesssecurityonline.info · Sep 9, 2026
-
CISA warns attackers exploit Cisco firewall flaw CVE-2026-20316securityaffairs.com · Jul 30, 2026
-
Cisco patches zero day flaw in Secure FMC after July attackswww.securityweek.com · Jul 30, 2026
-
Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentialssecurityonline.info · Jul 29, 2026
-
CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flawcisa.gov · Jul 29, 2026