Medium severity · published Jul 29, 2026
CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
RansomwareIn wildKEV
5.3
CVSS
35.1%
EPSS
Yes
On KEV
Description
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)35.1% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 29, 2026
Federal remediation dueAug 1, 2026
Ransomware campaign useKnown
Affected products
Which versions
CS
Cisco Secure Firewall Management Center (FMC) · Cisco
7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.2.0; +34 more · source: vendor
SF
Secure Firewall Management Center · Cisco
7.0.0 through 7.0.9; 7.2.0 through 7.2.11; 7.3.0 through 7.3.1.2; 7.4.0 through 7.4.7; 7.6.0 through 7.6.5; 7.7.0 through 7.7.12; +1 more · source: NVD
SF
Secure Firewall Management Center (FMC) · Cisco
All versions, or not specified · source: KEV
In the news
VulnerabilityCritical
Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), which is used for centrally managing multiple Cisco Secure Firewall devices across a network. Two FMC vulnerabilities under active attack “Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software,” the company’s researchers confirmed on Wednesday. These are the above mentioned CVE-2026-20079 and CVE-2026-20316, which Cisco flagged … More →
The post Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) appeared first on Help Net Security .
Sep 10, 2026·Help Net Security
VulnerabilityCritical
ZDI-26-533: Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-20316.
Aug 11, 2026·Zero Day Initiative
VulnerabilityHigh
Cisco FMC static credentials exploited by attackers (CVE-2026-20316)
A static credentials vulnerability (CVE-2026-20316) in Cisco Secure Firewall Management Center (FMC), a platform for centrally managing multiple Cisco Secure Firewall devices across a network, is being leveraged by attackers, CISA warned. Two FMC flaws, one indicator of compromise CVE-2026-20316, reported by Jimi Sebree of Horizon3.ai, is found in the FMC software’s web interface. The static user credentials are for a low-privileged account, and they can be used by attackers to log in to an … More →
The post Cisco FMC static credentials exploited by attackers (CVE-2026-20316) appeared first on Help Net Security .
Jul 30, 2026·Help Net Security
VulnerabilityMedium
U.S. CISA adds a Cisco Secure Firewall Management Center (FMC) flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Cisco Secure Firewall Management Center (FMC) flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Secure Firewall Management Center (FMC) flaw, tracked as CVE-2026-20316 (CVSS score of 5.3), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-20316 is a […]
Jul 30, 2026·Security Affairs
VulnerabilityHigh
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation.
The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log
Jul 30, 2026·The Hacker News
VulnerabilityHigh
Cisco warns of FMC static credential flaw exploited in zero-day attacks
Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices. [...]
Jul 29, 2026·BleepingComputer
Affected product
CS
Cisco Secure Firewall Management Center (FMC)
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20316
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
More from Cisco Secure Firewall Management Center (FMC)
10.0
CVE-2026-20131
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
10.0
CVE-2026-20079
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
9.9
CVE-2026-20332
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Access Control Vulnerabilities
9.9
CVE-2026-20324
Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability
9.9
CVE-2026-20330
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities