CVE-2026-20316

Cisco Secure Firewall Management Center Use of Hard-coded Password

5.3 MEDIUMActively exploited (CISA KEV)Used in ransomwareEPSS 35.1%

Published29 Jul 2026
Added to CISA KEV29 Jul 2026
Remediation due1 Aug 2026

Description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityLow

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Cisco Secure Firewall Management Center≥ 10.0.0 ≤ 10.0.1 · ≥ 7.0.0 ≤ 7.0.9 · ≥ 7.2.0 ≤ 7.2.11 · ≥ 7.3.0 ≤ 7.3.1.2

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3CjhVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-20316 being actively exploited?

Yes. CVE-2026-20316 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 29 Jul 2026. It has been used in ransomware campaigns.

How severe is CVE-2026-20316?

CVE-2026-20316 has a CVSS 3.1 base score of 5.3, rated medium. EPSS estimates a 35.1% probability of exploitation.

Which products are affected by CVE-2026-20316?

Affected products include Cisco Secure Firewall Management Center.

How do I fix CVE-2026-20316?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-20316 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.