CISA Warns of Cisco Secure Firewall Management 0-Day Vulnerability Exploited in Attacks

CISA has issued a warning regarding a serious vulnerability in the Cisco Secure Firewall Management Center (FMC), which is currently being exploited in attacks.

The flaw, identified as CVE-2026-20316, affects Cisco’s centralized management platform for firewall solutions and could allow remote attackers to gain easy access to sensitive network environments.

The Cisco FMC, previously known as the Firepower Management Center, is widely used to manage firewall policies, events, and intrusion detection settings across enterprise networks, making this vulnerability particularly significant.

The issue arises from a hard-coded password in the Cisco Secure Firewall Management Center. This weakness falls under the CWE-259 category, which refers to software shipped with built-in credentials that users cannot easily change or remove.

Consequently, an unauthenticated attacker, whether on the network or the internet, could log in to an affected FMC instance using a low-privilege account without valid credentials.

Cisco Secure Firewall Management Vulnerability Exploited

Once inside, the attacker could access sensitive configuration data, security policies, event logs, and other information that could facilitate further compromises of protected systems.

Although current reports have not confirmed that CVE-2026-20316 is being exploited in specific ransomware campaigns, CISA emphasizes that the potential impact is severe enough to warrant immediate attention.

Since the FMC serves as a central control point for firewall deployments, unauthorized access could allow threat actors to weaken defenses, alter security rules, or gather intelligence about an organization’s security configuration.

This type of access is especially valuable in multi-stage attacks, where adversaries first gain a low-privileged foothold and then move laterally or escalate privileges using information collected from management platforms.

CISA is urging organizations to prioritize applying vendor-provided mitigations and patches for Cisco Secure Firewall Management Center.

In line with BOD 26-04, CISA urges organizations to prioritize patching based on risk, assess internet-exposed FMC instances, and apply updates within the directive’s required timelines.

If effective mitigations are unavailable, CISA advises discontinuing use of the product to prevent exploitation of the hard-coded password issue.

Additionally, CISA recommends following its “Forensics Triage Requirements” to assist in incident response in environments where exploitation is suspected.

This includes collecting relevant logs, access records, and configuration data from the affected FMC appliances to determine whether unauthorized logins occurred and what data may have been accessed.

For cloud-hosted or hybrid deployments that utilize the Cisco Secure Firewall Management Center, organizations should also implement any cloud-specific guidance in BOD 26-04 to ensure consistent protection across all assets.

From a security operations perspective, this alert highlights the ongoing risk associated with hard-coded credentials in critical infrastructure and security tools.

Network defenders should review access logs for suspicious logins, verify that only authorized accounts can access the FMC interface, and restrict management access to trusted administrative networks whenever possible.