Cisco disclosed CVE-2026-20316 on July 29, a use-of-hard-coded-credentials flaw in Secure Firewall Management Center (FMC) that hands remote, unauthenticated attackers a working login on the appliance’s web interface. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day after Cisco’s own PSIRT confirmed active exploitation. There is no workaround — only Cisco’s hotfixes close the hole.

What happened

FMC is the centralized management console that administrators use to configure and monitor fleets of Cisco Secure Firewall (formerly FTD) appliances — policy, access control, IPS signatures, and VPN configuration all flow through it. CVE-2026-20316 traces to a low-privilege service account with a static, hardcoded password embedded in the FMC web UI codebase. Because the credential never changes and isn’t tied to any customer-configurable value, anyone who knows it — and it’s now public knowledge — can authenticate to a reachable FMC instance without a valid account of their own.

On its own, the account is low-privilege, which is why Cisco initially scored the flaw a CVSS 5.3. But Cisco’s advisory is explicit that the access it grants can be chained with other FMC vulnerabilities to escalate privileges within the system, which is the basis for Cisco’s own High severity rating and for CISA’s KEV inclusion. A foothold account that reads configuration data and can be pivoted into deeper compromise is a different threat model than an isolated low-severity bug — it’s a beachhead.

Technical details

  • CVE: CVE-2026-20316
  • CWE: CWE-798 (Use of Hard-coded Credentials)
  • CVSS: 5.3 (Cisco severity rating: High, due to chaining potential)
  • Affected component: Cisco Secure Firewall Management Center web interface
  • Affected releases: FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0
  • Attack vector: Network, unauthenticated — direct login to the FMC web UI using the hardcoded low-privilege credential
  • Exploitation status: Confirmed active exploitation in the wild, added to CISA KEV on July 29, 2026

Exploitation requires nothing beyond network reachability to the FMC management interface — no credential theft, no social engineering, no prerequisite foothold. Any FMC instance exposed to an untrusted network, or reachable by an attacker who has already landed elsewhere on the internal network, is exploitable in a single authenticated-looking request that costs the attacker nothing to obtain.

Impact

FMC sits at the center of an organization’s firewall fleet. An attacker who authenticates via the hardcoded account gains access to whatever data that low-privilege role can read — device inventory, policy configuration, and other management-plane data — which is itself useful for reconnaissance ahead of a larger intrusion. Combined with any other FMC bug that allows privilege escalation, the static account becomes a stepping stone to full management-plane compromise: the ability to rewrite firewall policy, disable inspection, or push malicious configuration to every managed appliance in the fleet.

Because FMC is typically deployed by mid-size and large enterprises running significant Cisco firewall estates, and because CISA’s KEV listing confirms exploitation is already happening, this is not a theoretical chaining scenario — it’s an active attack path against production security infrastructure.

Mitigation

  • Patch immediately. Cisco has published hotfixes for FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There is no workaround short of applying the fix — Cisco’s advisory is explicit on this point.
  • Restrict management-plane exposure. FMC web interfaces should never be reachable from the internet. Confirm access is limited to a trusted management network or VPN, and audit for any instances that were inadvertently exposed.
  • Federal agencies: CISA’s KEV addition carries a binding operational directive deadline — check the catalog entry for the exact remediation date and treat this as a priority patch cycle item alongside any other KEV-listed appliance in your environment.
  • Hunt for compromise indicators. Review FMC authentication logs for logins using the low-privilege service account, particularly from unfamiliar source IPs, and check for any downstream configuration changes originating from sessions that used it.
  • Assume chaining risk. Given Cisco’s own warning about combining this flaw with other FMC vulnerabilities, prioritize patching any other outstanding FMC CVEs in your environment at the same time.

Full details are in Cisco’s security advisory and the CISA KEV catalog entry; consult both for the authoritative hotfix links and applicability matrix for your specific FMC deployment.