DaystoPatch

CiscoExploited incident

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

CVE-2026-20316Medium, CVSS 5.3In CISA's Known Exploited Vulnerabilities catalog since 29 Jul 2026

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 22 hours after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
22h
First public report to first fix
Follow-through
22h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-fmc-static-cred-BET3CjhClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7eefc1145c7bbf4f…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CISA KEV (CVE-2026-20316)ClaimedQuote verified29 Jul 2026

    Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

    Added to CISA's KEV catalog on 2026-07-29.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-fmc-static-cred-BET3CjhClaimedQuote verified29 Jul 2026, 16:00 UTC

    Cisco Secure Firewall Management Center Software Static Credential Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:72fdb4e72b6cfb78…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-fmc-static-cred-BET3Cjh, v1.0 (Wayback snapshot 2026-07-30)CuratedQuote verified29 Jul 2026, 16:00 UTC

    In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

    Exploitation was disclosed in v1.0 of the advisory ('First Published: 2026 July 29 16:00 GMT'). Help Net Security and BleepingComputer coverage followed on 2026-07-30; no earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:85a86979adb4d0a6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20316ClaimedQuote verified29 Jul 2026, 16:22 UTC

    A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:71ec2f51702239bb…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet29 Jul 2026, 19:35 UTC

    🛑 CVE-2026-20316

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet29 Jul 2026, 21:10 UTC

    Cisco's firewall management console shipped with a password anyone can use - now in CISA KEV. 9 detections, 32 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T L-2026-1759 #

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-fmc-static-cred-BET3CjhClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7eefc1145c7bbf4f…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-fmc-static-cred-BET3CjhCuratedQuote not checked yet29 Jul 2026, 16:00 UTC

    First Published: 2026 July 29 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +22h

    Cisco PSIRT advisory cisco-sa-fmc-static-cred-BET3Cjh, v1.0 (Wayback snapshot 2026-07-30)CuratedQuote verified

    Cisco has released the following hot fixes to address this vulnerability. Customers can download the hot fixes from the Software Center on Cisco.com.

    v1.0 shipped hot fixes for FMC 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:85a86979adb4d0a6…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Cisco advisory cisco-sa-fmc-static-cred-BET3CjhClaimedQuote verified5 Aug 2026, 14:39 UTC

    Updated information about customer action with hot fixes.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7eefc1145c7bbf4f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-fmc-static-cred-BET3CjhClaimedQuote verified16 Sep 2026, 16:05 UTC

    Added Fixed Releases table and removed Hot Fixes table. Added reference to security hardening releases.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7eefc1145c7bbf4f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +22h

    Cisco PSIRT advisory cisco-sa-fmc-static-cred-BET3Cjh, v1.0 (Wayback snapshot 2026-07-30)CuratedQuote verified

    First Published: 2026 July 29 16:00 GMT

    v1.0 hot-fix table covers every FMC train then listed (7.0, 7.2, 7.4, 7.6, 7.7, 10.0). The live page (v1.6, 2026-09-16) replaced hot fixes with hardening releases and adds 10.1 -> 10.1.0, i.e. the first 10.1 release is already fixed.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:85a86979adb4d0a6…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-fmc-static-cred-BET3Cjh

    Recorded in the revision history

    Cisco Secure Firewall Management Center Software Static Credential Vulnerability

    Version table: 7 rows added and 6 rows removed. One new row reads "7.0 and earlier | 7.0.10".

    • Fixed versions
    Version table rows
    Before7.0 | Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar; 7.2 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar; 7.4 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar; 7.6 | Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
    After7.0 and earlier | 7.0.10; 7.2 | 7.2.12; 7.4 | 7.4.8; 7.6 | 7.6.6
    Earlier version captured 14 Aug 2026, 17:48 UTC: archived copyLater version captured 4 Oct 2026, 00:55 UTC: archived copyRecovered from archived copiesSnapshots 31996025b2… and 7eefc1145c…Incident page

  2. cisco-sa-fmc-static-cred-BET3Cjh

    Recorded in the revision history

    Cisco Secure Firewall Management Center Software Static Credential Vulnerability

    Revision 1.3 date changed from 2026-08-05 to 2026-08-03.

    • Revision date changed
    Revision 1.3 date
    Before2026-08-05
    After2026-08-03
    Earlier version captured 5 Aug 2026, 17:02 UTC: archived copyLater version captured 14 Aug 2026, 17:48 UTC: archived copyRecovered from archived copiesSnapshots 7b3786fe78… and 31996025b2…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Secure Firewall Management Center (FMC) Software
How we built this timeline

Severity follows Cisco's CVSS base score 5.3 (medium); Cisco itself rates the advisory SIR High because the account 'can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges'.

Horizon3.ai's page lists a different score (8.9); we use Cisco's. Reported by Jimi Sebree (Horizon3.ai);

Andy Niu (TrendAI Research) was added in revision 1.5 (2026-AUG-11). KEV lists known ransomware use;

Talos (9 Sep 2026, https://blog.talosintelligence.com/fmc-ongoing-exploitation/) attributes a cluster using these static credentials to UAT-11988, with TTPs consistent with Qilin ransomware affiliates. The same hot-fix packages also fixed CVE-2026-20079 (tracked separately as cisco-cve-2026-20079; see that file for the grouping decision).

Revision dates on the live page differ slightly from snapshots for the 31 Jul 2026..08-05 IOC edits; they do not affect any moment here.

Related

Cisco report card