{"id":"CVE-2026-20316","kind":"vulnerability","aliases":["CVE-2026-20316"],"related":[],"title":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an…","description":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged&nbsp;account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.&nbsp;\r\nNote:&nbsp;If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.&nbsp;&nbsp;\r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.","summary":"Every self-hosted Cisco Secure FMC build ships a static low-privileged web-interface account, so an unauthenticated remote attacker can log in and read sensitive data. Cisco rates it High (CVSS 5.3 base) because it chains with other FMC bugs, for example CVE-2026-20079 (auth bypass to root), which Talos saw exploited alongside it. Exploited in the wild since July 2026 and in CISA KEV with known ransomware use. Cisco says there is no workaround.","severity":"critical","cvss":5.3,"epss":null,"exploited":true,"exploited_at":"2026-07-29T00:00:00+00:00","products":[{"name":"Cisco Secure Firewall Management Center (FMC)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Cisco Secure Firewall Management Center (FMC)","fixed":["7.0.10","7.2.12","7.4.8","7.6.6","7.7.13","10.0.2","10.1.0"],"affected":"7.0.0-7.0.9, 7.2.0-7.2.11, 7.3.x, 7.4.0-7.4.7, 7.6.0-7.6.5, 7.7.0-7.7.12, 10.0.0-10.0.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 7.0.0, <= 7.0.9","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 7.2.0, <= 7.2.11","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 7.3.0, <= 7.3.1.2","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 7.4.0, <= 7.4.7","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 7.6.0, <= 7.6.5","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 7.7.0, <= 7.7.12","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":">= 10.0.0, <= 10.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","firewall-management-center","infrastructure","network-security","ransomware","self-hosted"],"not_affected_if":["already-on-fixed-release","cloud-delivered-fmc","fdm-managed-only","unaffected-versions-unknown"],"how_to_check":"Check version in FMC (Help > About) against the fixed releases. For signs of compromise, in expert mode as root run: zgrep \"package_info.*license\" /var/log/messages*. Output containing /var/tmp/license.tmp means it may have been exploited; contact Cisco TAC. Cisco Software Checker also works.","fix":"Upgrade FMC to the first fixed release: 7.0.10 (7.0 and earlier), 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, or 10.1.0. Hot fixes are superseded by these hardening releases. Hot fixes and upgrades only prevent future exploitation and do not clean an existing compromise. Until patched, block public internet access to the FMC management interface.","status":"open","published_at":"2026-07-29T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:32:04+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T20:32:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and fixed release from Cisco's advisory, following CISA BOD 26-04 guidance; if no mitigation is available, discontinue use of the product per the CISA entry. Exact fixed versions are unknown from these sources.","summary":"Cisco Secure Firewall Management Center contains a hard-coded password that lets an unauthenticated remote attacker log in with a low-privileged account and access sensitive data on the managed system. CISA lists it as actively exploited in the wild and tags it with ransomware use.","category":"infrastructure","who_cares":["cisco","firewall-management-center","self-hosted","network-security"],"confidence":0.6,"analyst_note":"Pull affected and fixed versions and the exact hard-coded account details from Cisco's advisory for CVE-2026-20316 and the CISA KEV entry, and confirm whether cloud-managed FMC is affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unaffected-versions-unknown"],"severity_if_unknown":"critical"},"cost_usd":0.000411,"input_tokens":2274,"output_tokens":368,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Pull affected and fixed versions and the exact hard-coded account details from Cisco's advisory for CVE-2026-20316 and the CISA KEV entry, and confirm whether cloud-managed FMC is affected.","search":"'-20079':132B '-2026':18A,21A,131B '-20316':19A,22A '2026':149B '5.3':119B 'access':198C,254C,274C 'account':101B,196C,221C,231C 'advisori':291C 'affect':189C,237C,251C 'allow':16A,179C,243C 'alongsid':141B 'assign':288C 'associ':280C 'attack':106B,183C,223C,245C,276C 'auth':133B 'base':120B 'bug':127B 'build':91B 'bypass':134B 'center':12A,27A,33A,39A,44A,49A,54A,59A,64A,69A,75B,175C 'chain':123B 'cisa':152B 'cisco':8A,23A,29A,35A,40A,45A,50A,55A,60A,65A,70B,88B,114B,158B,171C,286C,317C 'could':15A,178C,224C,242C 'credenti':215C 'cve':17A,20A,130B 'cvss':118B 'data':113B,200C,256C 'devic':190C 'due':208C 'elev':323C 'everi':84B 'exampl':129B 'exploit':71B,140B,143B,225C,241C 'firewal':10A,73B,173C 'firewall':25A,31A,37A,42A,47A,52A,57A,62A,67A 'firewall-management-cent':72B 'fmc':13A,28A,34A,90B,126B,176C,266C,319C 'high':117B,298C 'host':83B,87B 'impact':203C,294C 'indic':305C 'infrastructur':76B 'interfac':6A,100B,169C,268C 'internet':273C 'juli':148B 'kev':153B 'known':155B 'log':108B,185C,233C,247C 'low':96B,194C,219C,260C 'low-privileg':95B,193C,218C,259C 'manag':11A,74B,174C,267C 'management':26A,32A,38A,43A,48A,53A,58A,63A,68A 'medium':301C 'network':78B 'network-secur':77B 'note':263C 'presenc':211C 'privileg':97B,195C,220C,261C,324C 'public':272C 'ransomwar':80B,156B 'rate':115B,295C 'rather':299C 'read':111B 'reason':307C 'reduc':285C 'remot':105B,182C 'root':136B 'saw':139B 'say':159B 'score':304C 'secur':9A,79B,89B,172C,290C,293C,318C 'secure':24A,30A,36A,41A,46A,51A,56A,61A,66A 'self':82B,86B 'self-host':81B,85B 'sensit':112B,199C,255C 'ship':92B 'sinc':147B 'sir':296C 'softwar':14A,177C,320C 'static':94B,213C 'success':240C 'surfac':277C 'system':204C,238C,252C 'talo':138B 'unauthent':104B,181C 'use':157B,191C,229C,314C 'user':214C,262C 'vulner':2A,165C,206C,227C,283C,311C,321C 'web':5A,99B,168C 'web-interfac':98B 'wild':146B 'within':201C 'workaround':163B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-29T00:00:00+00:00","kev":{"dateAdded":"2026-07-29","dueDate":"2026-08-01","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20316","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316","severity":null,"published_at":"2026-07-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-20316:99","url":null,"severity":null,"published_at":"2026-10-23T21:32:50+00:00","modified_at":"2026-10-23T21:32:50+00:00","first_seen_at":"2026-10-23T21:32:50+00:00","fetched_at":"2026-10-23T21:32:50+00:00","note":"Read Cisco advisory (v1.6, 2026-09-16): fixed releases, IOC command, cdFMC not affected. Exploited since July 2026 (Cisco, Talos, KEV). Account username/password not published by Cisco; left unknown. No public PoC link found; no X chatter."},{"source":"nvd","external_id":"CVE-2026-20316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20316","severity":null,"published_at":"2026-07-29T17:16:51+00:00","modified_at":"2026-09-16T21:17:10+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":1088,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-fmc-static-cred-BET3Cjh.html","title":"Cisco advisory cisco-sa-fmc-static-cred-BET3Cjh","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1089,"url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/","title":"Talos: Active exploitation of Cisco Secure FMC vulnerabilities","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":1090,"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20316/","title":"Horizon3: CVE-2026-20316 Cisco FMC","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1091,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-095/","title":"CSA Singapore alert AL-2026-095","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}