On July 29, 2026, Cisco published an advisory for CVE-2026-20316, a static credential vulnerability in Secure Firewall Management Center (FMC) Software, and confirmed that its PSIRT had become aware of active exploitation during July. The flaw was reported by Jimi Sebree of Horizon3.ai.

The vulnerability is exactly what the category name says. Cisco Secure FMC ships with static credentials for a built-in low-privilege account. An unauthenticated, remote attacker who possesses those credentials can log into an affected system and read the data available to that account.

There are no workarounds. Patch or remain exposed.

The Score Is Wrong and Cisco Knows It

CVE-2026-20316 carries a CVSS score of 5.3 — nominally medium. Cisco assigned it a High severity rating anyway, and the advisory is explicit about why: the access can be chained with other FMC vulnerabilities to elevate privileges.

This is the failure mode of scoring vulnerabilities in isolation. CVSS asks what one flaw does by itself. Attackers ask what one flaw does when combined with the next one and with the role the box plays in the network.

FMC is not a workload. It is the management plane for an organisation’s firewall estate — the system that holds policy, pushes rule changes, aggregates event data and, by design, has authenticated reach into every Firepower device it manages. A low-privilege foothold on the console that governs the perimeter is not a medium-severity condition. It is pre-positioning inside the control system for the boundary.

Anyone triaging by CVSS number alone will have deprioritised this. That is the intended behaviour of a lot of vulnerability management programmes, and it is precisely the gap that produced a zero-day here.

What Is and Is Not Affected

Cisco confirmed the following are not vulnerable:

  • Cloud-Delivered FMC
  • Firewall Device Manager
  • Secure Firewall ASA Software
  • Secure Firewall Threat Defense Software
  • Security Cloud Control

The exposure is specific to on-premises Secure FMC Software. That scoping matters operationally: organisations that moved firewall management into Cisco’s cloud-delivered offering sit outside the blast radius, while those running the traditional on-prem management appliance — typically the larger, more regulated, more segmentation-conscious enterprises — are the ones exposed.

Cisco’s related advisory for CVE-2026-20079, a CVSS 10.0 authentication bypass, has no observed active exploitation. The pairing is instructive. The perfect-10 flaw is unexploited; the 5.3 is being used in the wild. Attackers optimise for reliable access, not for scores.

A Third Edge Management Failure in Three Days

This lands in the middle of a run. On July 30 we covered a CVSS 10 in the Arista VeloCloud SD-WAN controller and a symlink bypass in FortiOS, both added to CISA’s KEV catalogue with a three-day remediation deadline. Cisco FMC now joins them.

The common thread is not a vendor problem. It is a category problem. Edge and edge-management appliances share a set of properties that make them the most attractive targets in enterprise networks:

  • They terminate untrusted traffic by definition
  • They are frequently internet-reachable for remote administration
  • They run vendor-controlled firmware that customers cannot inspect
  • They are patched on maintenance windows measured in weeks because taking the firewall manager down takes change control with it
  • They are trusted implicitly by everything behind them

Hardcoded credentials in that class of device are a decades-old defect that keeps reappearing because the engineering pressure that creates them — a service account needed for internal component communication, easier to ship with a fixed value than to provision per-install — never goes away.

What to Do

  1. Patch Secure FMC now. There is no mitigation, no configuration change, and no workaround to buy time with.
  2. Assume compromise if FMC was internet-reachable. Exploitation predates the advisory. A patch closes the door; it does not evict anyone already inside.
  3. Audit FMC authentication logs for logins to low-privilege built-in accounts, particularly from external addresses.
  4. Review policy change history across managed Firepower devices for modifications you cannot attribute to a change ticket.
  5. Remove FMC from internet exposure entirely. Management planes belong behind a bastion or VPN, not on a public address.

Step 2 is the one that gets skipped. A confirmed zero-day means the window between first exploitation and first patch was open for an unknown period, and every organisation running affected FMC spent that window undefended.

Sources

  • Cisco Security Advisory cisco-sa-fmc-static-cred-BET3Cjh, July 29, 2026
  • BleepingComputer, Cisco warns of FMC static credential flaw exploited in zero-day attacks
  • Help Net Security, Cisco FMC static credentials exploited by attackers (CVE-2026-20316)
  • SecurityWeek, Cisco Secure FMC Zero-Day Exploited in the Wild