Cisco Secure FMC Zero-Day Exploited in the Wild

Summary

Cisco has released patches for a zero-day vulnerability, CVE-2026-20316, affecting its Secure Firewall Management Center (FMC). The flaw allows remote, unauthenticated attackers to log into devices using default credentials. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediation for government organizations.

Full text

Cisco on Wednesday announced patches for an actively exploited zero-day vulnerability affecting its Secure Firewall Management Center (FMC) product. The security hole, tracked as CVE-2026-20316, has been described as a static credential issue. Specifically, an attacker can leverage default credentials for a low-privilege user account to log into vulnerable devices and access sensitive data. Cisco assigned a ‘high severity’ rating to the vulnerability, noting that it can be chained with other FMC flaws to escalate privileges. “If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced,” Cisco said in its advisory. The networking giant said it became aware of the active exploitation of CVE-2026-20316 in July, and it has made available indicators of compromise (IoCs) to enable organizations to detect attacks. A researcher from security firm Horizon3.ai has been credited with reporting the vulnerability. Horizon3.ai has yet to disclose any information about CVE-2026-20316.Advertisement. Scroll to continue reading. There does not seem to be any public information describing the attacks involving the zero-day. The cybersecurity agency CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, instructing government organizations to address it by August 1. Cisco on Wednesday also updated its advisory for CVE-2026-20079, a critical FMC vulnerability patched in March. The company has not mentioned in-the-wild exploitation, but it has made available IoCs for detecting potential attacks. Over the past couple of months, Cisco became aware of the exploitation of several vulnerabilities, including in Catalyst SD-WAN Manager and Unified Communications Manager products. Related: Critical Command Execution Vulnerability Patched in Cisco ISE Related: Cisco SD-WAN Zero-Day Exploited Months Before Patching Related: Unpatched Fastjson Vulnerability Exploited in Attacks Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Dozens of Minnesota Water Utilities Targeted in Coordinated OT AttacksCyera Acquiring Oasis Security in $1 Billion DealApple Patches 87 Vulnerabilities in iOS, 155 in macOS TahoeMicrosoft Unveils MAI-Cyber-1-Flash, Its First Cybersecurity AI Model Origin Energy Data Breach Affects 900,000 AustraliansNvidia and Tech Giants Launch AI Security AllianceCoca-Cola Confirms Data Breach After Fairlife Ransomware AttackAnthropic’s Opus 5 Nears Mythos 5 on Finding Bugs, but Falls Short on Exploits Latest News Chrome 151 Patches 370 VulnerabilitiesUS Bans Foreign-Made Humanoid Robots, Targeting China Over National SecurityMate Security Raises $35 Million for Agentic SOCThreatLocker Raises $190 Million in Series F FundingCritical VM Escape Vulnerability Patched in VMware ESXiUS, Australia Release OT Isolation Guidance for Critical Infrastructure OpenAI’s Rogue AI Ventured Beyond Hugging FaceSpur Raises $200 Million for IP Intelligence Platform Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveThe Department of Energy has appointed Andrew McClure as Director of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER).Sumo Logic has appointed Chris Malone as CEO and Conor Burns as CFO.Nozomi Networks has appointed co-founder Andrea Carcano as CEO.More People On The MoveExpert Insights Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-20316
• cve — CVE-2026-20079

Entities