Skip to content
Sign in

Cisco product

Secure Firewall Management Center

Alert
No CISA KEV deadline is open. CISA last added a Secure Firewall Management Center CVE on 29 Jul.

Tracked since 4 Mar · latest article 17 Sep · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 2 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date2

Secure Firewall Management Center CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Secure Firewall Management Center CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-20316RansomwareSecure Firewall Management Center (FMC)29 JulPassed 1 Aug10
In CISA KEVCVE-2026-20131RansomwareSecure Firewall Management Center (FMC)19 MarPassed 22 Mar18
Vendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Secure Firewall Management Center CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’251Q1 ’260Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20261
Q4 20260

Fix listed

2 of 6 CVEs in coverage

4 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-20079: 99.8th percentile, in CISA KEVCVE-2026-20131: 98.7th percentile, in CISA KEVCVE-2026-20316: 98.4th percentile, in CISA KEVCVE-2026-20242: 59.1th percentileCVE-2026-20324: 49.8th percentileCVE-2026-20344: 42.2th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-2007999.8
CVE-2026-2013198.7
CVE-2026-2031698.4
CVE-2026-2024259.1
CVE-2026-2032449.8
CVE-2026-2034442.2

Coverage33 articles · all time

The latest 33 articles naming Secure Firewall Management Center, in the shared story grammar.

Full timeline
Quiet for 6 weekslast report 17 Sep33 articles9 outlets

33 articles from 9 outlets since 4 Mar. Quiet since 17 Sep.

Now4 Mar2992021328 Jul1629920213First reportSecurity Affairs · 4 Mar, 22:51CISA alert19 Mar, 17:36 · official
  • Wed 4 Mar, 22:51 UTC. Security Affairs, first report. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 08:56 UTC. SecurityWeek, its first report on the story. Cisco patches 50 flaws after authentication bypass CVE-2026-20079. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 10:57 UTC. Infosecurity, its first report on the story. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 20:43 UTC. Dark Reading, its first report on the story. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass. Cites a CVE in CISA KEV.
  • Wed 18 Mar, 16:42 UTC. The Hacker News, its first report on the story. Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 06:56 UTC. The Hacker News. CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 09:29 UTC. SecurityWeek. Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 09:59 UTC. Security Affairs. Interlock group exploiting the CISCO FMC flaw CVE-2026-20131 36 days before disclosure. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 09:59 UTC. Infosecurity. AWS Warns Hackers Have Abused Cisco Firewall Zero-Day Since January. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 17:36 UTC. CISA, its first report on the story. CISA Adds One Known Exploited Vulnerability to Catalog. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 17:47 UTC. CISA. CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 18:06 UTC. Security Affairs. U.S. CISA adds a flaw in Cisco FMC and Cisco SCC Firewall Management to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 18:28 UTC. CISA. CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Fri 20 Mar, 13:21 UTC. Dark Reading. Interlock Ransomware Targets Cisco Enterprise Firewalls. Cites a CVE in CISA KEV.
  • Mon 23 Mar, 11:04 UTC. Infosecurity. CISA Orders US Government to Patch Maximum Severity Cisco Flaw. Cites a CVE in CISA KEV.
  • Thu 2 Apr, 17:52 UTC. Security Affairs. Cisco fixed critical and high-severity flaws.
  • Tue 12 May, 12:11 UTC. SOCRadar, its first report on the story. Discord and Gemini Database Claims, Cisco FMC RCE Leak, Xia Stealer Sale, and IMSS Donor Records Listing. Cites a CVE in CISA KEV.
  • Mon 18 May, 12:11 UTC. Securelist, its first report on the story. Kaspersky blocks 343M attacks as ransomware variants surge in Q1 2026. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 21:10 UTC. CISA. CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 23:10 UTC. SecurityOnline, its first report on the story. Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 06:50 UTC. SecurityWeek. Cisco patches zero day flaw in Secure FMC after July attacks. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 10:00 UTC. Security Affairs. CISA warns attackers exploit Cisco firewall flaw CVE-2026-20316. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 07:51 UTC. SecurityWeek. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear.
  • Wed 9 Sep, 23:28 UTC. SecurityOnline. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 01:32 UTC. CISA. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 11:36 UTC. The Hacker News. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 19:46 UTC. Security Affairs. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 02:36 UTC. SecurityOnline. Cisco Patches Firewall Flaws Enabling Unauthenticated Root Access.
  • Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 33 articles as a list
  1. Wed 4 MarDay 01
    1. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access22:51 · Security Affairs · First report · Exploited CVE · Known exploited CVE
  2. Thu 5 MarDay 13
    1. Cisco patches 50 flaws after authentication bypass CVE-2026-2007908:56 · SecurityWeek · Known exploited CVE
    2. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass10:57 · Infosecurity · Known exploited CVE
    3. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass20:43 · Dark Reading · Known exploited CVE

  3. Quiet for 13 days

    Wed 18 MarDay 141
    1. Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access16:42 · The Hacker News · Picked up again · Known exploited CVE
  4. Thu 19 MarDay 158
    1. CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks06:56 · The Hacker News · Known exploited CVE
    2. Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks09:29 · SecurityWeek · Known exploited CVE
    3. CISA Adds One Known Exploited Vulnerability to Catalog17:36 · CISA · official · CISA alert · Known exploited CVE
    Show 5 more from 19 Mar
    1. Interlock group exploiting the CISCO FMC flaw CVE-2026-20131 36 days before disclosure09:59 · Security Affairs · Known exploited CVE
    2. AWS Warns Hackers Have Abused Cisco Firewall Zero-Day Since January09:59 · Infosecurity · Known exploited CVE
    3. CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalogue17:47 · CISA · official · Known exploited CVE
    4. U.S. CISA adds a flaw in Cisco FMC and Cisco SCC Firewall Management to its Known Exploited Vulnerabilities catalog18:06 · Security Affairs · Known exploited CVE
    5. CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalogue18:28 · CISA · official · Known exploited CVE
  5. Fri 20 MarDay 161
    1. Interlock Ransomware Targets Cisco Enterprise Firewalls13:21 · Dark Reading · Known exploited CVE

  6. Quiet for 3 days

    Mon 23 MarDay 191
    1. CISA Orders US Government to Patch Maximum Severity Cisco Flaw11:04 · Infosecurity · Picked up again · Known exploited CVE

  7. Quiet for 10 days

    Thu 2 AprDay 291
    1. Cisco fixed critical and high-severity flaws17:52 · Security Affairs · Picked up again

  8. Quiet for 6 weeks

    Tue 12 MayDay 691
    1. Discord and Gemini Database Claims, Cisco FMC RCE Leak, Xia Stealer Sale, and IMSS Donor Records Listing12:11 · SOCRadar · Picked up again · Known exploited CVE

  9. Quiet for 6 days

    Mon 18 MayDay 751
    1. Kaspersky blocks 343M attacks as ransomware variants surge in Q1 202612:11 · Securelist · Picked up again · Known exploited CVE

  10. Quiet for 10 weeks

    Wed 29 JulDay 1472
    1. CISA flags Cisco FMC CVE‑2026‑20316 hardcoded password flaw21:10 · CISA · official · Picked up again · Known exploited CVE
    2. Cisco FMC flaw CVE-2026-20316 lets hackers use hidden credentials23:10 · SecurityOnline · Known exploited CVE
  11. Thu 30 JulDay 1482
    1. Cisco patches zero day flaw in Secure FMC after July attacks06:50 · SecurityWeek · Known exploited CVE
    2. CISA warns attackers exploit Cisco firewall flaw CVE-2026-2031610:00 · Security Affairs · Known exploited CVE

  12. Quiet for 7 days

    Thu 6 AugDay 1551
    1. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear07:51 · SecurityWeek · Picked up again

  13. Quiet for 5 weeks

    Wed 9 SepDay 1891
    1. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access23:28 · SecurityOnline · Picked up again · Known exploited CVE
  14. Thu 10 SepDay 1904
    1. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access01:32 · CISA · official · Known exploited CVE
    2. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Known exploited CVE
    3. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack11:36 · The Hacker News · Known exploited CVE
    4. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day19:46 · Security Affairs · Known exploited CVE
  15. Fri 11 SepDay 1912
    1. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware07:48 · The Hacker News · Known exploited CVE
    2. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE

  16. Quiet for 3 days

    Mon 14 SepDay 1941
    1. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink22:16 · Dark Reading · Picked up again · Known exploited CVE

  17. Quiet for 2 days

    Thu 17 SepDay 1972
    1. Cisco Patches Firewall Flaws Enabling Unauthenticated Root Access02:36 · SecurityOnline · Picked up again
    2. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation12:30 · SecurityWeek

All CVEs in coverage6

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-20079Exploited

    Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

    10.0Critical88% EPSS · 14 articles
  • CVE-2026-20131Exploited

    Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

    10.0Critical43% EPSS · 18 articles
  • CVE-2026-20316Exploited

    Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

    5.3Medium35% EPSS · 10 articles
  • CVE-2026-20242

    Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

    9.8Critical0.9% EPSS · 1 article
  • CVE-2026-20324

    Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability

    9.9Critical0.6% EPSS · 1 article
  • CVE-2026-20344

    Cisco Secure Firewall Management Center Software SQL Injection Vulnerability

    8.8High0.5% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in