CVE-2026-20316: Cisco Secure FMC Static Credential Login (KEV, ransomware)

CVE-2026-20316 is a hard-coded, low-privileged account baked into Cisco Secure Firewall Management Center's web interface that lets a remote, unauthenticated attacker log in and pull sensitive data, and CISA's KEV catalog records it as already used in ransomware activity with no workaround available.

CVE-2026-20316 is a Use of Hard-coded Password (CWE-259) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, formerly known as Firepower Management Center. NVD's Analyzed record states the flaw is "due to the presence of static user credentials for a low-privileged account," and that "an attacker could exploit this vulnerability by using the account to log in to an affected system" and read sensitive data as that low-privileged user (NVD).

NVD has not published its own independent Primary CVSS score for this record; the only metric on file is the Cisco PSIRT's CNA-submitted Secondary rating of CVSS v3.1 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. So the 5.3 shown here is the CNA Secondary score, not an NVD-confirmed Primary score (NVD).

Cisco's own advisory (cisco-sa-fmc-static-cred-BET3Cjh, published 2026-07-29, last updated 2026-09-16) assigns this a Security Impact Rating of High rather than Medium, explaining that although the CVSS base score is 5.3, "this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges." The advisory states there are no workarounds, lists first-fixed releases of 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0 for the respective trains (no fix is listed for the 7.3 train), confirms Cloud-Delivered FMC, FDM, ASA Software, FTD Software and Security Cloud Control are not affected, and states that Cisco PSIRT became aware of active exploitation of this vulnerability in July 2026 (Cisco Security Advisory cisco-sa-fmc-static-cred-BET3Cjh).

CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-29 with a required-action due date of 2026-08-01, and — unlike most KEV entries, which mark ransomware use as "Unknown" — flags this one's knownRansomwareCampaignUse as Known (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.3510 (98.43th percentile) — unusually high for a 5.3-rated flaw, consistent with its confirmed exploitation and ransomware use (FIRST EPSS).

Because there is no workaround and the account can be chained with other FMC bugs, any on-premises Secure FMC deployment on an affected build should be upgraded to the fixed release immediately, with the management interface kept off the public internet in the meantime.

• A hard-coded, low-privileged static account in the Cisco Secure FMC web interface lets a remote, unauthenticated attacker log in and access sensitive data. — NVD
• CVSS v3.1 base score is 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — the Cisco PSIRT's CNA Secondary rating; NVD has not published its own Primary score. — NVD
• Cisco rates this High (not Medium) because it can be chained with other FMC vulnerabilities to elevate privileges; no workaround exists; first-fixed releases are 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0 (no fix listed for 7.3); Cloud-Delivered FMC, FDM, ASA and FTD Software are not affected; Cisco PSIRT observed active exploitation in July 2026. — Cisco Security Advisory cisco-sa-fmc-static-cred-BET3Cjh
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-29, required-action due date 2026-08-01, with knownRansomwareCampaignUse marked Known. — CISA KEV
• EPSS score is 0.3510 (98.43th percentile) as of 2026-10-27. — FIRST EPSS