CISA Warns of Actively Exploited Zero-Day in Cisco Firewall Management Center

CISA alerts on a zero-day flaw in Cisco's Secure Firewall Management Center (CVE-2026-20316), urging immediate patching and credential rotation.

By Content Team

Jul 31, 2026

ON THIS PAGE

CISA is warning organizations about an actively exploited zero-day in Cisco's Secure Firewall Management Center (FMC), tracked as CVE-2026-20316. The flaw stems from a hard-coded password baked into the software, letting unauthenticated attackers log in with a low-privilege account — no credentials needed. Cisco rates it CVSS 5.3, but High impact, because it chains.

Once inside, attackers can view firewall policies, security rules, and event logs, potentially setting the stage for deeper network compromise. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 July under BOD 26-04, giving federal agencies until 1 August to fix it.

Cisco has released hotfixes for versions 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Patch, then rotate every credential, key and certificate on the FMC device — exploitation has been ongoing, so patching alone won't evict anyone already inside. Check logs for suspicious /var/tmp/license.tmp references, and keep the management interface off the public internet.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?