--- id: "CVE-2026-20316" kind: "vulnerability" aliases: ["CVE-2026-20316"] title: "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an\u2026" severity: "critical" cvss: 5.3 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Cisco Secure Firewall Management Center (FMC)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Cisco Secure Firewall Management Center (FMC)", "fixed": ["7.0.10", "7.2.12", "7.4.8", "7.6.6", "7.7.13", "10.0.2", "10.1.0"], "affected": "7.0.0-7.0.9, 7.2.0-7.2.11, 7.3.x, 7.4.0-7.4.7, 7.6.0-7.6.5, 7.7.0-7.7.12, 10.0.0-10.0.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 7.0.0, <= 7.0.9", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 7.2.0, <= 7.2.11", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 7.3.0, <= 7.3.1.2", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 7.4.0, <= 7.4.7", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 7.6.0, <= 7.6.5", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 7.7.0, <= 7.7.12", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": ">= 10.0.0, <= 10.0.1", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cisco", "exploited", "firewall-management-center", "infrastructure", "network-security", "ransomware", "self-hosted"] not_affected_if: ["already-on-fixed-release", "cloud-delivered-fmc", "fdm-managed-only", "unaffected-versions-unknown"] published_at: "2026-07-29T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:51+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:32:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20316", "first_seen_at": "2026-10-23T23:44:51+00:00"}] --- # A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an… Every self-hosted Cisco Secure FMC build ships a static low-privileged web-interface account, so an unauthenticated remote attacker can log in and read sensitive data. Cisco rates it High (CVSS 5.3 base) because it chains with other FMC bugs, for example CVE-2026-20079 (auth bypass to root), which Talos saw exploited alongside it. Exploited in the wild since July 2026 and in CISA KEV with known ransomware use. Cisco says there is no workaround. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Cisco Secure Firewall Management Center (FMC) affected ? fixed ? - vendor:Cisco Secure Firewall Management Center (FMC) affected 7.0.0-7.0.9, 7.2.0-7.2.11, 7.3.x, 7.4.0-7.4.7, 7.6.0-7.6.5, 7.7.0-7.7.12, 10.0.0-10.0.1 fixed 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0 - vendor:cisco secure firewall management center affected >= 7.0.0, <= 7.0.9 fixed ? - vendor:cisco secure firewall management center affected >= 7.2.0, <= 7.2.11 fixed ? - vendor:cisco secure firewall management center affected >= 7.3.0, <= 7.3.1.2 fixed ? - vendor:cisco secure firewall management center affected >= 7.4.0, <= 7.4.7 fixed ? - vendor:cisco secure firewall management center affected >= 7.6.0, <= 7.6.5 fixed ? - vendor:cisco secure firewall management center affected >= 7.7.0, <= 7.7.12 fixed ? - vendor:cisco secure firewall management center affected >= 10.0.0, <= 10.0.1 fixed ? ## How to check Check version in FMC (Help > About) against the fixed releases. For signs of compromise, in expert mode as root run: zgrep "package_info.*license" /var/log/messages*. Output containing /var/tmp/license.tmp means it may have been exploited; contact Cisco TAC. Cisco Software Checker also works. ## Fix Upgrade FMC to the first fixed release: 7.0.10 (7.0 and earlier), 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, or 10.1.0. Hot fixes are superseded by these hardening releases. Hot fixes and upgrades only prevent future exploitation and do not clean an existing compromise. Until patched, block public internet access to the FMC management interface. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316 - 2026-10-23T21:32:50+00:00 analyst — Read Cisco advisory (v1.6, 2026-09-16): fixed releases, IOC command, cdFMC not affected. Exploited since July 2026 (Cisco, Talos, KEV). Account username/password not published by Cisco; left unknown. No public PoC link found; no X chatter. - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20316 ## Documents - [advisory] Cisco advisory cisco-sa-fmc-static-cred-BET3Cjh https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-fmc-static-cred-BET3Cjh.html - [describes] Horizon3: CVE-2026-20316 Cisco FMC https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20316/ - [discussion] Talos: Active exploitation of Cisco Secure FMC vulnerabilities https://blog.talosintelligence.com/fmc-ongoing-exploitation/ - [mentions] CSA Singapore alert AL-2026-095 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-095/ ## From the sources A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_