CVE-2026-20316 – Cisco Secure Firewall Management Center (FMC)

This patch addresses CVE-2026-20316, a CWE-259 (Use of Hard-coded Password) vulnerability affecting Cisco Secure Firewall Management Center (FMC). The CVSS score is 5.3, which is Medium severity. Verified active exploitation has been reported, resulting in an overall Red vulnerability rating despite the Medium CVSS score.

The vulnerability is caused by the presence of static credentials for a low-privileged account within the FMC web interface. An unauthenticated remote attacker can use these credentials to log in to an affected device and access sensitive information available to that account. While the attack surface is reduced when the FMC management interface is not exposed to the public internet, affected systems remain at risk. Cisco also notes that this vulnerability can be combined with other Cisco Secure FMC vulnerabilities to achieve privilege escalation, increasing its overall security impact. The vulnerability is not identified as Remote Code Execution (RCE) or Elevation of Privilege (EoP) on its own.