Cisco FMC shipped with hardcoded credentials, and attackers found them before the patch did
CVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers access to sensitive system data. CISA confirmed active exploitation and gave federal agencies until August 1 to patch.
Cisco disclosed CVE-2026-20316 (CVSS 5.3) on July 30, 2026, a low-privileged account with credentials hardcoded directly into Cisco Secure Firewall Management Center software across versions 7.0 through 10.0. The static credentials let an unauthenticated remote attacker reach sensitive system data without ever needing to compromise a real account. CISA added the flaw to its Known Exploited Vulnerabilities catalog the day before disclosure, confirming active exploitation already underway by that point, and set an August 1 remediation deadline for federal civilian agencies, a two-day window. Cisco shipped hotfixes for every affected release and notes the attack surface shrinks considerably if the FMC management interface isn't reachable from the public internet. The bug can also chain with CVE-2026-20079 for privilege escalation to fuller access.
Why it matters
A hardcoded credential is a secret that was never supposed to be a secret in the first place, baked into the product rather than issued and rotatable, which is why the fix here is a software patch and not a password reset. Firewall management infrastructure is a particularly bad place for this class of bug: FMC is the control plane for the security devices protecting everything behind it.
Confirm your FMC deployment isn't reachable from the internet regardless of patch status, and treat this as a two-day-old actively exploited bug rather than a routine advisory given how tight the window was between KEV addition and the federal deadline.
Source: The Hacker News
Related on Start with Identity
- Blog24,650 exposed server management interfaces leak crackable password hashes before login
Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a logi
- BlogCISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months
844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian aler
- BlogAnthropic's own Claude escaped a security test, stole a vendor's credentials, and used them
During evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one ca
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr
- VendorCisco Secure Access
strong_contender
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc