CVE-2026-20316
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Description
CVE-2026-20316 is a hard-coded password vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software. The product ships with static user credentials for a low-privileged account, so an unauthenticated remote attacker can simply log in with that account and access sensitive data on the affected system. Cisco has assigned this advisory a Security Impact Rating of High rather than the Medium its CVSS 5.3 suggests, because the vulnerability can be chained with other Cisco Secure FMC Software vulnerabilities to elevate privileges. FMC releases across the 7.0 through 7.7 and 10.0 trains are affected. CISA lists CVE-2026-20316 in the Known Exploited Vulnerabilities (KEV) catalog and has confirmed its use in ransomware campaigns, with an EPSS score of roughly 11% at the 96th percentile.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure firewall management center | >= 7.0.0, <= 7.0.9; >= 7.2.0, <= 7.2.11; >= 7.3.0, <= 7.3.1.2; >= 7.4.0, <= 7.4.7; >= 7.6.0, <= 7.6.5; >= 7.7.0, <= 7.7.12; >= 10.0.0, <= 10.0.1 |
References
Weakness Type
CWE-259: Use of Hard-coded Password
Use of a hard-coded password occurs when a product embeds a password directly in its source code, configuration files or binary, whether for authenticating incoming users or for connecting to external services. Such credentials are identical across every installation and cannot be changed by administrators, so once the value is known — and it inevitably becomes known — every deployment is accessible. In CVE-2026-20316 Cisco Secure FMC ships with static credentials for a low-privileged account that an attacker can use directly against the web interface.
Learn more: CWE-259 — Use of Hard-coded Password
Impact Analysis
CVE-2026-20316 is remotely exploitable over the network with low attack complexity, no authentication and no user interaction — the attacker logs in with credentials that are the same on every affected appliance. The CVSS impact metrics are deliberately narrow: confidentiality impact is Low while integrity and availability are unaffected, because the static account is low-privileged and yields read access to sensitive data rather than control of the device. That is why the base score is only 5.3 — and why Cisco overrode it, stating that the Security Impact Rating is High because this vulnerability can be used together with other Cisco Secure FMC Software vulnerabilities to elevate privileges. Read that alongside CVE-2026-20079, the unauthenticated root-access flaw in the same product, and the chaining risk is concrete. Cisco also notes that if the FMC management interface has no public internet access, the associated attack surface is reduced — the single most useful mitigating fact here. CISA's ransomware flag and the EPSS score of about 11% in the 96th percentile confirm this is being exploited in earnest.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-20316 and flags it as known to be used in ransomware campaigns, the catalog's most serious classification and an escalation from its earlier status. The EPSS score of roughly 11%, in the 96th percentile, is strikingly high for a vulnerability rated Medium by CVSS and indicates that exploitation is widespread rather than incidental — consistent with a static credential, which requires no exploit development at all once the value circulates. Cisco's own advisory is the only vendor source and does not publish the credential, but hard-coded passwords are routinely recovered from firmware and shared, so the absence of a published value offers no protection. The realistic attack model is a ransomware affiliate using this account to gain an authenticated foothold on an internet-reachable FMC and then chaining a second FMC vulnerability to reach root; any appliance that was exposed while unpatched warrants a compromise assessment.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with Cisco's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 1 August 2026 has long passed and the entry is flagged for known ransomware use.
- Apply Cisco's fixed FMC software release. Affected versions span 7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12 and 10.0.0 through 10.0.1; the fix is documented in Cisco advisory cisco-sa-fmc-static-cred-BET3Cjh. A static credential cannot be changed by configuration — only the software update removes it.
- Remove the FMC management interface from public internet access. Cisco states explicitly that doing so reduces the attack surface associated with this vulnerability; bind the management interface to a dedicated management VLAN or jump-host range and block it at the perimeter, which is both an immediate mitigation here and the standing correct posture for a firewall management plane.
- Patch the chainable FMC vulnerabilities at the same time. Because Cisco's High rating rests on privilege escalation through combination with other FMC flaws, treat this advisory together with the other Cisco Secure FMC vulnerabilities affecting your version — notably the unauthenticated root-access issue CVE-2026-20079 — and apply a release that fixes all of them rather than the minimum build for this CVE alone.
- Hunt for compromise and harden long term. Review FMC access logs for logins using the static account and for access to firewall policy and configuration data from unexpected sources, check for new administrative users and unexplained policy changes, and validate deployed firewall rules against a trusted baseline; then rotate all FMC credentials, enable multi-factor authentication for administrative access, and — given the confirmed ransomware association — verify that offline, restorable backups of the FMC configuration exist.
Technical Details
CVE-2026-20316 is a use of hard-coded password flaw (CWE-259) in the web interface of Cisco Secure Firewall Management Center Software. The product contains static user credentials for a low-privileged account, embedded in the software rather than generated per installation, and the web interface accepts them for login. An attacker who possesses the credential value — which, being identical across all deployments, spreads as soon as anyone extracts it — authenticates as that user and reads sensitive data within the affected system. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N records a network-reachable, low-complexity attack requiring no privileges and no interaction, with low confidentiality impact only and unchanged scope. The gap between that 5.3 score and Cisco's High Security Impact Rating is the important technical point: CVSS scores this flaw in isolation, while Cisco assesses it as a component of a chain, where an authenticated low-privileged session on FMC is the foothold that other FMC vulnerabilities convert into elevated privileges on a device that controls an organisation's firewall policy.
Frequently Asked Questions
Is CVE-2026-20316 being actively exploited?
Yes, and CISA has confirmed its use in ransomware campaigns — the KEV ransomware flag is set to "Known". Its EPSS score of about 11% places it in the 96th percentile, which is very high for a CVSS Medium vulnerability and reflects that exploiting a static credential requires no exploit development once the value is known.
What products are affected by CVE-2026-20316?
Cisco Secure Firewall Management Center (FMC) Software is affected in versions 7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12 and 10.0.0 through 10.0.1. Cisco notes that the attack surface is reduced if the FMC management interface has no public internet access.
How do I fix CVE-2026-20316?
Apply the fixed FMC software release from Cisco advisory cisco-sa-fmc-static-cred-BET3Cjh — a hard-coded credential cannot be removed by configuration, only by the update. Also remove the FMC management interface from public internet access, and patch the other Cisco Secure FMC vulnerabilities affecting your version at the same time, since Cisco's High rating is based on privilege escalation through chaining.
How severe is CVE-2026-20316?
Its CVSS 3.1 base score is 5.3 (Medium), reflecting unauthenticated network access to a low-privileged account with read-only exposure of sensitive data. However, Cisco assigns a Security Impact Rating of High because the flaw can be combined with other FMC vulnerabilities to elevate privileges, and CISA has confirmed use in ransomware campaigns — so it should be treated as a high-priority patch despite the Medium base score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.