Cisco has released emergency security updates for CVE-2026-20316, a high-severity zero-day vulnerability in its Secure Firewall Management Center software that is being actively exploited in the wild. The flaw stems from static credentials embedded in the FMC web interface, allowing unauthenticated remote attackers to gain access to affected devices.
The Cybersecurity and Infrastructure Security Agency confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities catalog, directing federal agencies and critical infrastructure operators to apply patches immediately. CISA warned that the flaw could expose sensitive configuration data, firewall rules, and network credentials stored on affected management servers.
Cisco urged all customers running affected FMC versions to rotate all user credentials, API keys, and certificates on impacted devices, noting that the embedded static credentials may have been compromised even before patches were available. The company said it became aware of the issue after detecting unauthorized access attempts against customer environments.
The vulnerability affects Cisco Secure FMC, a centralized management platform used to configure and monitor multiple Cisco Secure Firewall devices across enterprise networks. An attacker exploiting CVE-2026-20316 could potentially gain full administrative control over the management plane, including the ability to modify firewall policies and exfiltrate stored credentials.
Security researchers at multiple firms, including SOC Prime and Help Net Security, published analysis confirming that the static credentials are extractable from the FMC software, making exploitation straightforward for any attacker with network access to the management interface. The flaw does not require authentication or user interaction to exploit.
The incident underscores the ongoing risk of hardcoded credentials in enterprise network equipment, a class of vulnerability that has plagued vendors from Cisco to Juniper in recent years. Organizations are advised to ensure FMC management interfaces are not exposed to untrusted networks and to apply the available patches as soon as possible.
Sources: SecurityWeek, BleepingComputer, The Hacker News
discussion