Skip to content
VulniPulse
Sign in
Medium5.3Vendor: HighCisco Exploited CISA KEV

Medium [CVE-2026-20316] Cisco Secure Firewall Management Center Software Static Credential Vulnerability

This medium-severity Cisco advisory covers CVE-2026-20316 affecting Secure Firewall Management Center (FMC) Appliances.

cisco-sa-fmc-static-cred-BET3Cjh Published Jul 29, 2026Updated by vendor Aug 11, 2026
CVE-2026-20316
Affected products & platforms
CiscoFirewallASA / Firepower
Open vendor advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

This vulnerability is due to the presence of static user credentials for a low-privileged account. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.

Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected product named by the advisory: Secure Firewall Management Center (FMC) Appliances.

CISA Known Exploited Vulnerability

Listed:
Jul 29, 2026 · federal remediation due Aug 1, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use:
Known

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • Scope: This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.
  • Release 7.0 (affected unless hot fix Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar is installed)
  • Release 7.2 (affected unless hot fix Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar is installed)
  • Release 7.4 (affected unless hot fix Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar is installed)
  • Release 7.6 (affected unless hot fix Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar is installed)
  • Release 7.7 (affected unless hot fix Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar is installed)
  • Release 10.0 (affected unless hot fix Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar is installed)
  • Release 7.3 (affected; no hot fix is listed in this advisory)

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Fixed versions
  • Release 7.0 — Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
  • Release 7.2 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
  • Release 7.4 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
  • Release 7.6 — Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
  • Release 7.7 — Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
  • Release 10.0 — Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Install the Cisco hot fix listed for your FMC release train.
  • Release 7.0: install Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar.
  • Release 7.2: install Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar.
  • Release 7.4: install Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar.
  • Release 7.6: install Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar.
  • Release 7.7: install Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar.
  • Release 10.0: install Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar.
Workaround status
  • There are no workarounds that address this vulnerability.

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.