CISA Adds Cisco Secure Firewall Management Center Vulnerability to KEV List

## Overview CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) list on July 29, 2026. This vulnerability affects Cisco Secure Firewall Management Center (FMC) Software. It allows unauthenticated remote attackers to log in using hard-coded credentials for a low-privileged account. The addition to the KEV list signals a federal deadline for agencies to address this vulnerability. ## Technical Details The vulnerability stems from static user credentials embedded within the FMC web interface. Attackers can exploit this weakness to gain access to sensitive data. The presence of hard-coded passwords means that even low-privileged accounts can be used to log in without proper authentication. Cisco has rated this vulnerability with a CVSS score of 5.3, indicating a moderate level of risk. ## Impact Successful exploitation of CVE-2026-20316 allows attackers to access sensitive data as low-privileged users. While the immediate threat is limited, the vulnerability can be combined with other weaknesses in the Cisco FMC Software to escalate privileges further. If the FMC management interface is not exposed to the public internet, the risk is somewhat mitigated. ## Mitigation Defenders should immediately update their Cisco Secure Firewall Management Center to the latest version. Regularly review access controls and limit public access to the FMC management interface. Organizations must prioritize patching this vulnerability to reduce the risk of unauthorized access and potential data breaches.