Cisco on Wednesday announced patches for an actively exploited zero-day vulnerability affecting its Secure Firewall Management Center (FMC) product.
The security hole, tracked as CVE-2026-20316, has been described as a static credential issue. Specifically, an attacker can leverage default credentials for a low-privilege user account to log into vulnerable devices and access sensitive data.
Cisco assigned a ‘high severity’ rating to the vulnerability, noting that it can be chained with other FMC flaws to escalate privileges.
“If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced,” Cisco said in its advisory.
The networking giant said it became aware of the active exploitation of CVE-2026-20316 in July, and it has made available indicators of compromise (IoCs) to enable organizations to detect attacks.
A researcher from security firm Horizon3.ai has been credited with reporting the vulnerability. Horizon3.ai has yet to disclose any information about CVE-2026-20316.
There does not seem to be any public information describing the attacks involving the zero-day.
The cybersecurity agency CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, instructing government organizations to address it by August 1.
Cisco on Wednesday also updated its advisory for CVE-2026-20079, a critical FMC vulnerability patched in March.
The company has not mentioned in-the-wild exploitation, but it has made available IoCs for detecting potential attacks.
Over the past couple of months, Cisco became aware of the exploitation of several vulnerabilities, including in Catalyst SD-WAN Manager and Unified Communications Manager products.
Related: Critical Command Execution Vulnerability Patched in Cisco ISE
Related: Cisco SD-WAN Zero-Day Exploited Months Before Patching
Related: Unpatched Fastjson Vulnerability Exploited in Attacks
Related: Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
