Cisco FMC shipped with hardcoded credentials, and attackers found them before the patch did
CVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers access to sensitive system data. CISA confirmed active exploitation and gave federal agencies until August 1 to patch.
Cisco disclosed CVE-2026-20316 (CVSS 5.3) on July 30, 2026, a low-privileged account with credentials hardcoded directly into Cisco Secure Firewall Management Center software across versions 7.0 through 10.0. The static credentials let an unauthenticated remote attacker reach sensitive system data without ever needing to compromise a real account. CISA added the flaw to its Known Exploited Vulnerabilities catalog the day before disclosure, confirming active exploitation already underway by that point, and set an August 1 remediation deadline for federal civilian agencies, a two-day window. Cisco shipped hotfixes for every affected release and notes the attack surface shrinks considerably if the FMC management interface isn't reachable from the public internet. The bug can also chain with CVE-2026-20079 for privilege escalation to fuller access.
Why it matters
A hardcoded credential is a secret that was never supposed to be a secret in the first place, baked into the product rather than issued and rotatable, which is why the fix here is a software patch and not a password reset. Firewall management infrastructure is a particularly bad place for this class of bug: FMC is the control plane for the security devices protecting everything behind it.
Confirm your FMC deployment isn't reachable from the internet regardless of patch status, and treat this as a two-day-old actively exploited bug rather than a routine advisory given how tight the window was between KEV addition and the federal deadline.
Source: The Hacker News
Related on Start with Identity
- Blog24,650 exposed server management interfaces leak crackable password hashes before login
Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a logi
- BlogTwo Cisco FMC flaws are being used to harvest credentials and to land Qilin ransomware
CVE-2026-20079 (CVSS 10.0) gives unauthenticated root on Cisco Secure Firewall Management Center, used to deploy web shells that query internal databases for cr
- BlogCISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months
844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian aler
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo