CVE-2026-20316
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
do firstApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Can a WAF block it? No. The vulnerability involves logging in using static credentials via the web interface, which looks like a normal login request and does not contain unusual or filterable patterns that a web application firewall could reliably block without affecting legitimate users.
Also consider: patch
Based on an AI reading of the CVE description, and no vendor rule found yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Is CVE-2026-20316 being exploited?
Yes. CVE-2026-20316 appears in CISA's Known Exploited Vulnerabilities catalog, which means exploitation in the wild has been confirmed and reported. Treat it as active rather than theoretical, and patch it ahead of higher-scoring vulnerabilities that carry no exploitation evidence.
How severe is CVE-2026-20316?
CVE-2026-20316 is rated Medium with a CVSS score of 5.3. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-20316?
Yes. A fix has been recorded for CVE-2026-20316. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-20316 affect?
CVE-2026-20316 affects cisco:secure_firewall_management_center. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
- affected7.0.0
- affected7.0.0.1
- affected7.0.1
- affected7.0.1.1
- affected7.0.2
- affected7.2.0
- affected7.0.2.1
- affected7.0.3
- affected7.2.0.1
- affected7.0.4
- affected7.2.1
- affected7.0.5
- affected7.3.0
- affected7.2.2
- affected7.3.1
- affected7.2.3
- affected7.2.3.1
- affected7.2.4
- affected7.0.6
- affected7.2.4.1
- affected7.2.5
- affected7.3.1.1
- affected7.4.0
- affected7.0.6.1
- affected7.2.5.1
- affected7.4.1
- affected7.2.6
- affected7.4.1.1
- affected7.0.6.2
- affected7.2.7
- affected7.2.5.2
- affected7.3.1.2
- affected7.2.8
- affected7.6.0
- affected7.4.2
- affected7.2.8.1
- affected7.0.6.3
- affected7.4.2.1
- affected7.2.9
- affected7.0.7
- affected7.7.0
- affected7.4.2.2
- affected7.2.10
- affected7.6.1
- affected7.4.2.3
- affected7.0.8
- affected7.6.2
- affected7.7.10
- affected7.2.10.1
- affected7.0.8.1
- affected7.6.2.1
- affected7.2.10.2
- affected7.7.10.1
- affected7.4.2.4
- affected7.4.3
- affected7.6.3
- affected7.7.11
- affected7.6.4
- affected10.0.0
- affected7.4.4
- affected7.4.5
- affected7.0.9
- affected7.2.11
- affected7.7.12
- affected7.6.5
- affected7.4.6
- affected10.0.1
- affected7.4.7
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
cisa ssvc
- exploitation
- active
- automatable
- yes
- technical impact
- partial
Assessed by CISA 29 Jul 2026 (SSVC 2.0.3).
timeline
- 29 Jul 2026Added to CISA KEV (exploited in the wild)
- 29 Jul 2026CISA SSVC assessment: exploitation active · same day later
- 29 Jul 2026Published · 1 day later
- 1 Aug 2026CISA remediation due date (US federal agencies) · 2 days later
- 16 Sept 2026CVE record last updated · 47 days later
- 2 Nov 2026Analysed by vulneraibility.com · 47 days later
- Linksec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
- Linkcisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316
sources
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA KEV catalog: exploitation, date added, due date
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
- Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.