Cisco Patches Actively Exploited FMC Zero-Day CVE-2026-20316

Summary

Cisco patched actively exploited CVE-2026-20316 in Secure Firewall Management Center. Default credentials for a low-privilege account can expose sensitive data; CISA added the flaw to its KEV catalog. Public details about attacks are unavailable.

Key points

CVE-2026-20316 is a static-credential vulnerability in Cisco Secure Firewall Management Center.
Cisco says attackers can use default credentials for a low-privilege account to log in and access sensitive data; the flaw may be chained with other FMC vulnerabilities for privilege escalation.
Cisco became aware of active exploitation in July and released patches and indicators of compromise.
Cisco says restricting public internet access to the FMC management interface reduces the attack surface.
CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog and set an August 1 remediation deadline for government organizations.
Cisco also updated its advisory for CVE-2026-20079, a critical FMC flaw patched in March, and published detection indicators; it did not report in-the-wild exploitation of that flaw.

Article Details

Vulnerability Types: Static credential issue involving default credentials
Severity: High
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Restrict public internet access to the FMC management interface; Cisco said this reduces the attack surface.