Cisco Secure Firewall Management Center hard-coded password flaw CVE-2026-20316 exploited; fixed releases out
Cisco Secure Firewall Management Center has a built-in login that anyone on the network can use without a password (CVE-2026-20316). It was exploited before a fix existed. Upgrade to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.
Ask whoever runs your Cisco firewalls to upgrade FMC to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0, and to keep its management interface off the public internet. If compromise is suspected, contact Cisco TAC and rotate the credentials, keys and certificates the FMC manages.
What’s happening
Cisco Secure Firewall Management Center (FMC), the console that manages Cisco firewalls, contains a built-in password for a low-privileged web account. An attacker who can reach the FMC web interface can sign in with it without credentials and read sensitive data. Cisco scores it 5.3 on the CVSS scale but rates its own impact High, because the access can be combined with other FMC flaws to gain higher privileges. Horizon3.ai's page gives 8.9, so scores differ by source. Cisco said it learned of attacks in July 2026, and CISA listed the flaw as exploited on 29 July. The listing supplied to HARD says ransomware gangs are using it, but the vendor and researcher pages read do not name any attacker. Cloud-delivered FMC, Firewall Device Manager, ASA and Threat Defense software are not affected. Cisco first offered hot fixes, then on 16 September published fixed releases for each supported branch and replaced the hot fixes with hardening releases. Cisco's table lists no fix for the 7.3 branch, which Horizon3 lists as affected. There is no workaround.
- What
- Flaw
- Affects
- Cisco Secure Firewall Management Center (FMC) software
- Affected
- Cisco Secure FMC Software 7.0 and earlier
Cisco Secure FMC Software 7.2
Cisco Secure FMC Software 7.4
Cisco Secure FMC Software 7.6
Cisco Secure FMC Software 7.7
Cisco Secure FMC Software 10.0 - Fixed in
- 7.0.10
7.2.12
7.4.8
7.6.6
7.7.13
10.0.2
10.1.0 - Since
- 29 July 2026
- Closed
- 16 Sept 2026
Timeline
- New fixPartly fixed
Cisco's final advisory (version 1.6) replaced the hot fix table with a fixed-releases table: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0. Earlier hot fixes were replaced by hardening releases that include the fix.
- Vendor revised
Cisco revised its advisory (versions 1.1 to 1.4 between 31 July and 5 August) to correct a code example, tell customers to contact Cisco TAC if compromise is suspected, update a command-line check and update the customer action for hot fixes.
- CISA added
CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a 1 August 2026 deadline for US federal civilian agencies. Horizon3 and Kudelski Security published summaries the same day and urged customers to apply the hot fixes.
- Made publicPartly fixed
Cisco published advisory cisco-sa-fmc-static-cred-BET3Cjh for CVE-2026-20316, a built-in password for a low-privileged web account in Secure Firewall Management Center, and said it had become aware of active exploitation in July 2026. Hot fixes were offered and no workaround exists.
Sources
- Cisco Secure FMC Static Credential Vulnerability (cisco-sa-fmc-static-cred-BET3Cjh)Cisco · 16 Sept 2026
- CVE-2026-20316 Cisco Secure FMCHorizon3.ai · 30 July 2026
- Cisco Secure FMC hard-coded password exploited in zero-day attacksKudelski Security · 30 July 2026