CVE-2026-20316
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Description
CVE-2026-20316 is a use of hard-coded password vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software. The affected software ships with static user credentials for a low-privileged account, so an unauthenticated, remote attacker who knows those credentials can simply log in to the appliance and read sensitive data held by the management system. Rated CVSS 5.3 (Medium), the flaw exposes confidentiality only, but Cisco assigned the advisory a Security Impact Rating of High because CVE-2026-20316 can be combined with other Cisco Secure FMC Software vulnerabilities to elevate privileges. CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-08-01, which confirms that this Cisco FMC vulnerability is being exploited in the wild. Because FMC is the central policy and log console for an entire firewall estate, even low-privileged read access is a meaningful security exposure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure firewall management center | >= 7.0.0, <= 7.0.9; >= 7.2.0, <= 7.2.11; >= 7.3.0, <= 7.3.1.2; >= 7.4.0, <= 7.4.7; >= 7.6.0, <= 7.6.5; >= 7.7.0, <= 7.7.12; >= 10.0.0, <= 10.0.1 |
References
Weakness Type
CWE-259: Use of Hard-coded Password
Use of Hard-coded Password occurs when a product contains a password embedded directly in the source code, configuration files, or a binary, and uses it to authenticate incoming users or to connect to other components. In Cisco Secure Firewall Management Center the embedded credentials belong to a low-privileged local account that is present on every installation of the affected releases, so the same password works against any unpatched FMC appliance and cannot be changed by the operator without a vendor fix.
Learn more: CWE-259 — Use of Hard-coded Password
Impact Analysis
With a CVSS 3.1 base score of 5.3 (Medium), CVE-2026-20316 is remotely exploitable without physical access, easy to exploit with no special conditions needed, requires no authentication, and needs no user action — the only limiting factor is that the impact is confined to confidentiality. Confidentiality (Low): the static account can read sensitive data inside the management system, which on an FMC typically means device inventory, policy details, and event data that describe how a network is defended. Integrity and Availability (None): the account cannot change configuration or disrupt the service on its own. The practical risk is higher than 5.3 suggests, because Cisco states this vulnerability can be chained with other Secure FMC Software flaws to escalate privileges, and CISA has confirmed exploitation in the wild; an FMC management interface that is reachable from the internet should be treated as an urgent case, while an interface restricted to internal networks has a materially reduced attack surface.
Exploit Maturity
CVE-2026-20316 is listed in CISA's Known Exploited Vulnerabilities catalog, so active exploitation in the wild is confirmed; ransomware involvement is currently marked as Unknown. No public exploit code is linked in the available references — the published sources are the Cisco security advisory and the CISA KEV entry — but a static password is trivial to weaponise once it is known, and no exploit tooling is really needed beyond a login request. The EPSS score of 0.79% (52.6th percentile) reflects that broad automated scanning has not yet been observed, which understates the situation for internet-exposed FMC appliances. Cisco explicitly warns that this vulnerability can be used together with other Cisco Secure FMC Software vulnerabilities to elevate privileges, so treat any successful login by the static account as a likely first stage of a longer chain and patch before the 2026-08-01 KEV deadline.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-08-01.
- Install a fixed release as described in the Cisco security advisory cisco-sa-fmc-static-cred-BET3Cjh. The affected trains are 7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12, and 10.0.0 through 10.0.1 — upgrade past the last affected build in your train.
- Remove the FMC management interface from public internet exposure immediately. Cisco notes that the attack surface is reduced when the management interface has no public internet access, so restricting it to a management VLAN reachable only over VPN or a jump host is an effective interim mitigation.
- Review FMC authentication logs for successful logins by unexpected local accounts and for access from unfamiliar source addresses, and check for follow-on privilege escalation attempts, since the account is intended to be used as a stepping stone rather than an end goal.
- As long-term hardening against hard-coded credentials (CWE-259), inventory appliances for vendor-shipped default and static accounts, require unique credentials to be set during commissioning, and place management planes behind network controls so that an undiscovered embedded account cannot be reached from untrusted networks.
Technical Details
The root cause of CVE-2026-20316 is the presence of static user credentials for a low-privileged account in Cisco Secure Firewall Management Center Software (CWE-259): the password is fixed in the product rather than generated per installation, so it is identical across every deployment of an affected release and remains valid until Cisco changes it in a patch. Exploitation requires nothing more than sending the credentials to the FMC web interface login, which is why the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N records a network attack vector with low complexity, no privileges, and no user interaction. The scope stays unchanged (S:U) and only confidentiality is affected at Low (C:L), because the account's own rights are limited to reading data in the management system. The severity gap between the CVSS score of 5.3 and Cisco's Security Impact Rating of High comes from chaining: once an attacker holds an authenticated session, other Secure FMC Software vulnerabilities that require a valid low-privileged account become reachable, converting a read-only foothold into privilege escalation on the appliance that manages an organisation's firewalls.
Frequently Asked Questions
Is CVE-2026-20316 being actively exploited?
Yes. CVE-2026-20316 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild, with a federal remediation deadline of 2026-08-01. Ransomware usage is currently marked as Unknown, and the EPSS score of 0.79% places the vulnerability in the 53rd percentile of all CVEs, meaning mass automated exploitation has not yet been observed.
What products are affected by CVE-2026-20316?
The vulnerability affects Cisco Secure Firewall Management Center (FMC) Software in releases 7.0.0 to 7.0.9, 7.2.0 to 7.2.11, 7.3.0 to 7.3.1.2, 7.4.0 to 7.4.7, 7.6.0 to 7.6.5, 7.7.0 to 7.7.12, and 10.0.0 to 10.0.1. Only the FMC management appliance itself carries the static credentials, so the exposure depends on whether its web interface is reachable by an attacker.
How do I fix CVE-2026-20316?
Upgrade to a fixed release listed in Cisco's advisory cisco-sa-fmc-static-cred-BET3Cjh, since the hard-coded password cannot be changed by the operator. Until the upgrade is complete, block public internet access to the FMC management interface and review authentication logs for logins by unexpected local accounts.
How severe is CVE-2026-20316?
The CVSS 3.1 base score is 5.3 (Medium), reflecting unauthenticated remote access with a low confidentiality impact and no integrity or availability impact. Cisco nevertheless rates the advisory High, because the low-privileged session obtained through CVE-2026-20316 can be combined with other Secure FMC Software vulnerabilities to elevate privileges, and the CISA KEV listing shows the flaw is exploited in practice.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.