Hard-coded low-privilege credential in Cisco Secure FMC web interface enables unauthenticated login and chained privilege escalation (CVE-2026-20316)
Cisco Talos published a threat advisory on 2026-09-09 describing ongoing exploitation of two FMC vulnerabilities including this one, so any FMC still on an affected 7.0.x or 7.2.0.x build with a reachable management interface should be assumed to be a target for the credential-plus-bypass chain.
FMC ships with a static user account whose credentials let an unauthenticated remote attacker log in to the web interface and read sensitive data. Cisco rates the issue High rather than Medium because the foothold can be combined with other FMC vulnerabilities to elevate privileges, and Talos reports it being used alongside the CVE-2026-20079 authentication bypass.
Affected: Cisco Secure Firewall Management Center (FMC) 7.0.0; Cisco Secure Firewall Management Center (FMC) 7.0.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1.1; Cisco Secure Firewall Management Center (FMC) 7.0.2; Cisco Secure Firewall Management Center (FMC) 7.0.2.1; Cisco Secure Firewall Management Center (FMC) 7.0.3; Cisco Secure Firewall Management Center (FMC) 7.0.4; Cisco Secure Firewall Management Center (FMC) 7.2.0; Cisco Secure Firewall Management Center (FMC) 7.2.0.1
How to Test
Check the FMC software version shown in the web interface: 7.0.0 through 7.0.4 and 7.2.0/7.2.0.1 are affected. Determine whether the FMC management interface is reachable from the internet, since Cisco notes that exposure drives the attack surface. Review FMC web-interface authentication logs for successful logins by low-privileged accounts you did not create or from unexpected source addresses, and compare against the indicators in the Talos advisory at blog.talosintelligence.com/fmc-ongoing-exploitation/ for follow-on activity tied to CVE-2026-20079.
How to Patch
Upgrade FMC to the fixed release Cisco has published for your train under advisory cisco-sa-fmc-static-cred-BET3Cjh (Cisco bug CSCwt95997); Cisco states there are no workarounds. Until the upgrade completes, remove public internet access from the FMC management interface, which Cisco identifies as reducing the attack surface.