Cisco FMC Static Credential Flaw Exploited in Zero-Day Attacks

Cisco has issued a warning regarding a high-severity vulnerability in its Secure Firewall Management Center (FMC) Software, tracked as CVE-2026-20316. This flaw, caused by static credentials for a low-privilege account, allows unauthenticated remote attackers to gain unauthorized access to affected systems. Although the CVSS score is 5.3, Cisco rates it as High due to potential privilege escalation when combined with other vulnerabilities. The vulnerability affects multiple FMC versions but does not impact Cloud-Delivered FMC or other firewall software. Cisco became aware of the active exploitation in July 2026 but has not disclosed the attack's origins or targeted organizations. Administrators are advised to check log files for indicators of compromise and to apply hot fixes immediately. Additionally, Cisco updated an advisory for another critical vulnerability, CVE-2026-20079, which allows unauthenticated access and has a maximum CVSS score of 10.0.

Key Points: • CVE-2026-20316 is actively exploited, allowing unauthorized access to Cisco FMC systems. • Cisco rates the vulnerability as High despite a CVSS score of 5.3 due to potential privilege escalation. • Administrators must apply hot fixes immediately and monitor logs for signs of compromise.