CISA alerts to active exploitation of Cisco FMC CVE-2026-20316

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding an actively exploited vulnerability in Cisco's Secure Firewall Management Center (FMC), a critical platform used to centrally manage firewall deployments across enterprise networks. The flaw, tracked as CVE-2026-20316, involves hardcoded credentials for a low-privileged account that could allow attackers to log into vulnerable systems and access sensitive data.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 30, 2026, ordering federal civilian agencies to apply patches by August 1. Cisco confirmed its Product Security Incident Response Team became aware of active exploitation of the vulnerability in July 2026. The company has released hotfixes for affected software releases, including versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.

The vulnerability stems from static, hardcoded credentials for a built-in low-privileged user account within the FMC software's web interface. An unauthenticated, remote attacker could use these credentials to log into an affected device, potentially accessing sensitive configuration data, security policies, and event...