Cisco Warns of Static Credential Vulnerability in Secure Firewall Management Center Actively Exploited in Attacks

414/69 Friday, July 31, 2026 Cisco has issued an advisory for CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC) after discovering that the vulnerability has been exploited in zero-day attacks. The vulnerability is caused by the presence of static credentials within the system, which could allow attackers to use those credentials to gain unauthorized access to affected devices. Cisco has released software updates to address the vulnerability. Cisco stated that the vulnerability affects Cisco Secure Firewall Management Center, a centralized management system for Cisco Secure Firewall devices. The company updated its security advisory after receiving information that the vulnerability had been exploited in attacks. However, Cisco has not disclosed technical details of the attacks, indicators of compromise (IOCs), or information about the threat actors, as the investigation is still ongoing. Organizations using Cisco Secure Firewall Management Center should check their system versions and promptly install the updates released by Cisco. They should also review access logs and administrator account activity for anomalies and restrict access to administrative interfaces to trusted networks. If any devices have not yet been updated, remediation should be performed as soon as possible, as Cisco has confirmed that the vulnerability is already being actively exploited.