CISA Adds Cisco FMC CVE-2026-20316 to KEV

CISA added CVE-2026-20316 in Cisco Secure Firewall Management Center to its Known Exploited Vulnerabilities catalog on July 29, 2026, after confirming active exploitation. The U.S. agency also set an Aug. 1, 2026 remediation deadline for affected government organizations, according to SecurityWeek and other technical reports.

What did Cisco fix?

Cisco issued a security advisory the same day about a static credential issue in Cisco Secure Firewall Management Center, which it describes as a "static credential" problem. The company said there are no workarounds to mitigate CVE-2026-20316 and that the fix is to apply the software updates and hotfixes already available.

The vendor released specific patches for versions 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 of FMC software. MyTech-Blog also says Cisco published hotfixes for several Cisco Secure FMC branches, including 7.0, 7.2, 7.4, 7.6 and 7.7, in line with the official advisory.

How was it exploited and what was the technical scope?

SecurityWeek reported that Cisco announced the patches while the flaw was already being actively exploited as a zero-day. The Hacker News also said Cisco confirmed active exploitation in early July 2026, without giving an exact date or naming actors.

The technical description is consistent across the sources cited. Tenable lists it as a low-privilege static credential flaw that allows unauthenticated access to the FMC web interface. Cisco, according to the technical summary cited by MyTech-Blog, documents a low confidentiality impact and says it does not by itself enable configuration changes or code execution. Even so, f4n6.co.uk notes that the vendor classifies it internally with a Security Impact Rating High, because those credentials can be combined with other known FMC vulnerabilities to escalate privileges.

What indicators and response context were published?

The Hacker News said Cisco provided a specific diagnostic command, cat /var/log/messages | grep license, and that the presence of the /var/tmp/license.tmp path may be treated as a possible indicator of exploitation on an FMC device. Cisco also attributes the initial report to researcher Jimi Sebree, of Horizon3.ai.

CISA, meanwhile, posted on X that CVE-2026-20316, described as a case of "use of hard-coded password" in Cisco Secure Firewall Management Center, was added to KEV and urged organizations to apply available mitigations. WindowsForum linked that addition to Binding Operational Directive 26-04, which requires prioritizing remediation of high-risk KEV vulnerabilities on publicly exposed assets.

f4n6.co.uk broadened the affected scope using NVD CPE data and mentioned branches such as FMC 7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2 and 7.4.0 through 7.4.7. The Hacker News and BleepingComputer, as cited in other coverage, agree the flaw was used in zero-day attacks to gain unauthorized access to FMC devices.