Cyber Resilience

CVE-2026-20316

Exposed Creds in Cisco Secure Firewall Management Center 7.0.0 – 7.0.9

CISA KEVActive ExploitationEUVD ExploitedExposed Creds
Published
29 July 2026
Modified
01 August 2026
KEV Added
29 July 2026
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0079 53th percentile
Risk Priority 75 floored blend · peak EPSS

Summary

CVE-2026-20316 is a medium-severity Use of Hard-coded Password (CWE-259) vulnerability in Cisco Secure Firewall Management Center. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked in the top 47% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software stems from the presence of static user credentials for a low-privileged account. This flaw, tracked as CVE-2026-20316 and assigned CWE-259, enables unauthenticated remote access to sensitive data within affected systems and carries a CVSS 3.1 score of 5.3.

An unauthenticated remote attacker can exploit the issue simply by logging in with the hardcoded low-privileged account, gaining the ability to read sensitive information. The attack surface shrinks if the FMC management interface lacks public internet exposure, yet the vulnerability is rated High impact by Cisco because it can be chained with other FMC flaws to achieve privilege escalation.

The Cisco security advisory highlights the reduced risk when the management interface is not reachable from the internet and notes the potential for combined exploitation. The entry also appears in CISA's known exploited vulnerabilities catalog, confirming observed real-world use despite a current EPSS score of 0.0079.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This…

more

vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

CWE(s)
KEV Date Added
29 July 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-20131Same product: Cisco Secure Firewall Management Centerboth on KEV
CVE-2024-20374Same product: Cisco Secure Firewall Management Center
CVE-2023-20048Same product: Cisco Secure Firewall Management Center
CVE-2024-20300Same product: Cisco Secure Firewall Management Center
CVE-2023-20074Same product: Cisco Secure Firewall Management Center
CVE-2023-20005Same product: Cisco Secure Firewall Management Center
CVE-2024-20377Same product: Cisco Secure Firewall Management Center
CVE-2024-20424Same product: Cisco Secure Firewall Management Center
CVE-2024-20275Same product: Cisco Secure Firewall Management Center
CVE-2024-20298Same product: Cisco Secure Firewall Management Center

Affected Assets

cisco
secure firewall management center
7.0.0 — 7.0.9 · 7.2.0 — 7.2.11 · 7.3.0 — 7.3.1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Authenticator management requires secure distribution, rotation, and verification of credentials, directly stopping hard-coded passwords from being introduced or used.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prohibit embedding credentials in source code or binaries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring users to change temporary or default passwords at first use stops the continued existence of hard-coded or guessable passwords that are shipped with the product.

References