CVE-2026-20316 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-20316MEDIUM

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0079   53.4   YES

AFFECTED
  Product                                        Versions  Fixed
  Cisco Secure Firewall Management Center (FMC)  7.0.0 –   —

TIMELINE
  Oct 8   Reserved by cisco
  Jul 29  Added to CISA KEV, remediation due 2026-08-01
  Jul 29  Published (CNA: cisco)
  Aug 2   DUE DATE PASSED — CVE-2026-20316 (Cisco Secure Firewall Management Center (FMC)). CISA remediation deadline was August 1, 2026; still in catalog.

CWE-259 · CNA: cisco · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due August 1, 2026

Description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.  Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.   Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
October 8, 2025	Reserved	Reserved by cisco
July 29, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-08-01
July 29, 2026	Published	Published (CNA: cisco)
August 2, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-20316 (Cisco Secure Firewall Management Center (FMC)). CISA remediation deadline was August 1, 2026; still in catalog.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Cisco	Cisco Secure Firewall Management Center (FMC)	—	7.0.0	—

Weaknesses

CWE-259

References (2)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316 [US Government Resource]

Authoritative record: CVE-2026-20316 at cve.org

Vendors: cisco

Weaknesses: CWE-259

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-20316 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.