ZeroDayAlert

CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

Cisco Secure Firewall Management Center (FMC) Added to KEV 2026-07-29 Federal due 2026-08-01 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Cisco Secure Firewall Management Center (FMC), formerly known as Firepower Management Center, contains a hard-coded password vulnerability. An unauthenticated attacker on the network can log in with a low-privileged account to reach sensitive data. The record does not specify which versions of FMC are affected or whether only certain deployment modes (cloud, on-premises, or both) are in scope.

How to check whether this touches you

  • Inventory your Cisco FMC deployments: note hostname, deployment model (on-premises or cloud-hosted), and current version from the system dashboard.
  • Confirm network reachability by checking whether the FMC management interface (typically port 443) is accessible from untrusted networks, including the internet.
  • Retrieve the exact version number from the FMC console or API; version banners alone are not definitive because backported patches may exist outside standard release cycles.
  • If you operate a cloud-hosted FMC instance, verify the underlying service version through Cisco's cloud portal or support dashboard.
  • Check your configuration management database or asset discovery logs to identify all FMC instances you may have forgotten about.

What to do

  1. Obtain the specific list of affected versions and patches from Cisco's security advisory (linked in the CISA entry); do not rely on version number alone to determine status.
  2. If you cannot patch immediately, restrict network access to the FMC management interface to known administrative subnets using firewall rules or security group policies.
  3. Review and strengthen authentication controls on any accounts with access to FMC, even low-privileged ones, and audit recent login activity for those accounts.
  4. Enable logging of all authentication attempts and configuration changes on FMC; ship these logs to a centralised security information and event management (SIEM) system or syslog collector outside FMC itself.
  5. Plan patching according to CISA BOD 26-04 timelines; if the patch is unavailable or mitigations do not adequately reduce your risk, escalate to your change advisory board and security leadership for a decision on continued use.

If you find you were exposed

Exploitation of hard-coded credentials typically precedes detection and public disclosure by months or years. Examine FMC audit logs and authentication records as far back as your retention allows—at minimum the past 90 days—for successful logins from unexpected source addresses or at unusual times. Check for changes to firewall rules, user accounts, and policy objects that you do not recognise. If log retention on FMC is limited, query upstream syslog or SIEM records if they exist, and consider engaging Cisco support or a forensic specialist to help reconstruct the timeline of access.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-20316 is being exploited. It cannot tell you whether Secure Firewall Management Center (FMC) is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →