Cisco Releases Security Advisory for Vulnerability in Secure Firewall Management Center

Successful exploitation of CVE-2026-20316 could allow an unauthenticated remote attacker to log into an affected device using a low-privileged account and access sensitive information

Threat ID:: CC-4822
Threat Severity:: Medium
Published:: 30 July 2026 1:53 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-20316 could allow an unauthenticated remote attacker to log into an affected device using a low-privileged account and access sensitive information

Affected platforms

The following platforms are known to be affected:

Cisco Secure Firewall Management Center (FMC)

Version 7.0
- All versions prior to hotfix 7.0.9.1-3
Version 7.2
- All versions prior to hotfix 7.2.11.1-4
Version 7.4
- All versions prior to hotfix 7.4.7.1-3
Version 7.6
- All versions prior to hotfix 7.6.5.1-2
Version 7.7
- All versions prior to hotfix 7.7.12.1-2
Version 10.0
- All versions prior to hotfix 10.0.1.1-2

Note: This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.

Threat details

Exploitation of CVE-2026-20316

Cisco has confirmed that CVE-2026-20316 has been actively exploited in the wild and the vulnerability has been added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog.

The NHS England National CSOC assesses further exploitation as likely.

Introduction

Cisco has released a security advisory to address a high severity vulnerability in Cisco Secure Firewall Management Center (FMC) Software. Successful exploitation could allow an unauthenticated remote attacker to log into an affected device using a low-privileged account and access sensitive information.

CVE-2026-20316 - A use of hard-coded credentials vulnerability - CVSS v3.1 Base Score: 5.3

Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

This vulnerability may be chained with other Cisco Secure FMC Software vulnerabilities to achieve privilege escalation; however, Cisco has not disclosed which specific vulnerabilities can be chained with CVE-2026-20316.

Remediation advice

Affected organisations are encouraged to review Cisco advisory cisco-sa-fmc-static-cred-BET3Cjh and apply the relevant update as soon as possible.

Definitive source of threat updates

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

CVE Vulnerabilities

Status Published

CVE-2026-20316

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Last edited: 30 July 2026 1:53 pm