Loading vulnerability…
Hard-coded Credentials in Cisco Secure Firewall Management Center
CVE-2026-20316 is a hard-coded password vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software. Static credentials for a built-in, low-privileged account allow an unauthenticated remote attacker who knows those credentials to log in and access sensitive information available to the account. Exploitation requires neither prior privileges nor user interaction. The vulnerability has a CVSS v3.1 score of 5.3, but Cisco assigns it a High Security Impact Rating because attackers can combine it with other FMC vulnerabilities to escalate privileges. Active exploitation has been confirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes sensitive information accessible to the low-privileged account and provides unauthorized authenticated access to FMC. The standalone vulnerability has a confidentiality impact, with no established direct integrity or availability impact. When combined with additional FMC vulnerabilities, this access can support privilege escalation and broader compromise. Observed intrusions using this vulnerability for initial access have subsequently involved credential theft, reconnaissance, tunneling, Cyclops Blink deployment, and Qilin ransomware deployment; these subsequent capabilities are not direct effects of the static-credential flaw alone.
If you can’t patch tonight, do this now.
Remove public internet access to the FMC management interface and restrict access to a separate, trusted management environment. This reduces attack surface but does not prevent exploitation by an attacker who can still reach the interface. No complete workaround is identified. Monitor for unfamiliar web-interface logins, suspicious outbound connections, unexpected persistence, and other Cisco-documented exploitation indicators while arranging immediate patching.
Patch, then assume compromise.
Immediately install the Cisco security hotfix applicable to the deployed FMC release branch or upgrade to a supported release incorporating the fix. Branch-specific fixed update levels include 7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.5.1, 7.7.12.1, and 10.0.1.1; verify the exact hotfix and installation prerequisites with Cisco. Migrate unsupported releases to a supported, corrected version. Investigate existing installations for compromise separately, because patching does not remove an established intrusion. If compromise is suspected, contact Cisco TAC and rotate potentially exposed FMC credentials, managed-device credentials, directory or database credentials, keys, and certificates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
225 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.