Loading story…
Cisco disclosed active zero-day exploitation of CVE-2026-20316 in Secure Firewall Management Center (FMC), a static credential flaw caused by built-in credentials for a low-privilege account. The company warned that attackers could use the issue to gain unauthorized access to vulnerable FMC appliances and potentially chain it with other, undisclosed FMC vulnerabilities to escalate privileges. Cisco released hotfixes for affected Secure FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, said no workaround is available, and advised customers to check logs for the indicator /var/tmp/license.tmp and rotate credentials, keys, and certificates if compromise is suspected.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, underscoring that the flaw is being exploited in the wild and warning that compromise of FMC could let attackers change firewall policies, disrupt monitoring, and potentially move laterally across enterprise environments. Organizations were urged to identify exposed FMC deployments, apply Cisco's fixes, restrict access to management interfaces, and review logs and configurations for evidence of unauthorized access. Cisco also updated guidance for a separate FMC authentication bypass flaw, CVE-2026-20079, but said it has no evidence that issue has been exploited.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass and root command-execution flaw in Secure Firewall Management Center that can be triggered with crafted HTTP requests. Cisco said it was not aware of active exploitation of this vulnerability and released hotfixes for affected FMC versions.
CISA added Cisco Secure FMC vulnerability CVE-2026-20316 to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild. The listing elevated the issue for defenders because compromise of FMC could enable firewall policy changes, monitoring disruption, and lateral movement.
Cisco released hotfixes for vulnerable Secure FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 for CVE-2026-20316. The company said there are no workarounds and advised customers to review logs and rotate credentials, keys, and certificates if compromise is suspected.
Cisco disclosed CVE-2026-20316, a static credential vulnerability in Secure Firewall Management Center, and said it had been actively exploited as a zero-day to gain unauthorized access to vulnerable devices. Cisco noted attackers could potentially chain this access with other FMC flaws for privilege escalation and published indicators and response guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
23 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberveille.ch
Open sourcethecyberexpress.com
Open sourcethecybersecguru.com
Open sourcecve.org
Open sourcesdxcentral.com
Open sourcetools.cisco.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for two **maximum-severity** vulnerabilities in *Cisco Secure Firewall Management Center (FMC)* that can be exploited remotely by **unauthenticated** attackers via crafted HTTP requests to the web-based management interface. The issues include an **authentication bypass** (**CVE-2026-20079**) that can lead to **root access** on the underlying operating system and a **remote code execution** flaw (**CVE-2026-20131**) that allows execution of arbitrary Java code as root on unpatched systems. The Canadian Centre for Cyber Security highlighted Cisco’s advisories and urged administrators to review Cisco guidance and apply updates, noting impact to **Cisco Security Cloud Control (SCC) Firewall Management** and **Cisco Secure FMC** across versions. Cisco stated its PSIRT had **no evidence of active exploitation** and no public PoC at the time of publication, while also issuing fixes for additional vulnerabilities (including multiple high-severity issues) across Cisco firewall management and firewall platforms.
Jun 29, 2026
Cisco disclosed multiple vulnerabilities affecting **Secure Firewall Management Center (FMC)**, **Secure Firewall Threat Defense (FTD)**, and **Adaptive Security Appliance (ASA)** software, including a **remote code execution** flaw tied to RADIUS handling in FMC and a separate **authentication bypass** issue in on-premises FMC. Additional advisories describe a **path traversal** vulnerability in FMC and FTD, expanding the risk to core firewall management and security enforcement platforms used in enterprise environments. The broader set of advisories also includes a **Snort deep inspection bypass** in FTD, a **TLS/Snort 3 denial-of-service** issue, a **SAML reflected cross-site scripting** flaw affecting ASA and FTD, a **VPN web services client-side request smuggling** vulnerability, and a **Lua code injection** bug in ASA and FTD. Taken together, the disclosures show that Cisco firewall products were exposed to weaknesses spanning **code execution, access control, traffic inspection evasion, denial of service, and web interface exploitation**, creating multiple paths for attackers to disrupt defenses or gain elevated access if affected systems remain unpatched.
Jul 12, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026