Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-20316 is a medium-severity Use of Hard-coded Password (CWE-259) vulnerability in Cisco Secure Firewall Management Center. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked in the top 47% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software stems from the presence of static user credentials for a low-privileged account. This flaw, tracked as CVE-2026-20316 and assigned CWE-259, enables unauthenticated remote access to sensitive data within affected systems and carries a CVSS 3.1 score of 5.3.
An unauthenticated remote attacker can exploit the issue simply by logging in with the hardcoded low-privileged account, gaining the ability to read sensitive information. The attack surface shrinks if the FMC management interface lacks public internet exposure, yet the vulnerability is rated High impact by Cisco because it can be chained with other FMC flaws to achieve privilege escalation.
The Cisco security advisory highlights the reduced risk when the management interface is not reachable from the internet and notes the potential for combined exploitation. The entry also appears in CISA's known exploited vulnerabilities catalog, confirming observed real-world use despite a current EPSS score of 0.0079.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-50404
Vulnerability Data
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This…
more
vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
- CWE(s)
- KEV Date Added
- 29 July 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Authenticator management requires secure distribution, rotation, and verification of credentials, directly stopping hard-coded passwords from being introduced or used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prohibit embedding credentials in source code or binaries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring users to change temporary or default passwords at first use stops the continued existence of hard-coded or guessable passwords that are shipped with the product.