CVE-2026-20316: Cisco Secure Firewall Management Center (FMC) · Use of Hard-coded Password
Affects Cisco Secure Firewall Management Center (FMC)Source CVE Database V5
Exploited in the wild · used in ransomware campaigns · KEV due 1 Aug 2026 · 35% EPSS : apply the vendor's fix or mitigations to Cisco Secure Firewall Management Center (FMC) now.
Data as of 28 Oct 2026, 05:11 UTC
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
- Ransomware
- Used in ransomware campaigns
- EPSS
- 35.0% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 29 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by Cisco Systems, Inc.
, 294 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 46 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
, the same day as disclosure
KEV remediation due
US federal deadline
, 3 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-20316 (opens in a new tab)
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| CiscoCisco Secure Firewall Management Center (FMC) | Affected
| Fixed in– |
Check the firmware or software version for Cisco Secure Firewall Management Center (FMC) in the device's admin interface against the vendor advisory.
Description
CVE-2026-20316 is a vulnerability in Cisco Secure Firewall Management Center (FMC) software where a hard-coded, static password exists for a low-privileged account in the web interface. This allows an unauthenticated remote attacker to log in to the affected system using these credentials and access sensitive data. The vulnerability is rated as medium severity by CVSS but Cisco assigns a high security impact rating due to potential privilege escalation when combined with other vulnerabilities. The attack surface is reduced if the FMC management interface is not exposed to the public internet. Multiple versions of Cisco Secure FMC are affected.