Cisco says attackers have been using a flaw in Secure Firewall Management Center to get unauthorized access to vulnerable management systems. The zero-day, CVE-2026-20316, is caused by built-in static credentials for a low-privilege account and affects Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0; Cisco released hotfixes, said there are no workarounds, and published a /var/tmp/license.tmp log indicator that may show compromise. Cisco also updated guidance for separate critical FMC auth-bypass CVE-2026-20079, but said it is not aware of exploitation of that bug.
Lawrence Abrams
2026.09.23
88% relevant
The report specifically says CVE-2026-20316 was used together with CVE-2026-20079 in attacks on Cisco Secure Firewall Management Center, providing concrete linkage between the two FMC flaws and adding post-compromise details such as credential harvesting and tunneling tools.
Ionut Arghire
2026.09.17
74% relevant
This article adds that CVE-2026-20316 belongs to a broader September 2026 FMC patch set covering 18 CVEs, including eight critical bugs, and notes a same-class link with previously exploited FMC issues such as CVE-2026-20079.
info@thehackernews.com (The Hacker News)
2026.09.11
78% relevant
The article also overlaps with the broader Cisco Secure Firewall Management Center exploitation cluster by describing ransomware-linked abuse of FMC flaws, though the closer match is the already tracked CVE-2026-20079 exploitation story.
Lawrence Abrams
2026.09.10
97% relevant
This report materially advances the same underlying event by naming the second exploited flaw (CVE-2026-20079), describing three post-compromise clusters, and tying exploitation to Qilin ransomware affiliates and a Sandworm-overlap cluster that deployed Cyclops Blink, web shells, credential theft, reverse shells, and internal pivoting.
info@thehackernews.com (The Hacker News)
2026.09.10
92% relevant
This source likely advances the same Cisco event by adding that CISA has now listed the exploited Secure Firewall Management Center vulnerability in KEV and given federal agencies until September 12 to patch.
Eduard Kovacs
2026.09.10
84% relevant
This article adds that Talos sees three activity clusters exploiting Cisco Secure Firewall Management Center flaws, including campaigns involving CVE-2026-20079 and CVE-2026-20316, with Sandworm tied to exploitation of both and Qilin tied to CVE-2026-20316. It broadens the existing FMC exploitation story by linking the previously tracked CVE-2026-20316 activity to a second actively exploited FMC flaw and naming observed post-exploitation payloads such as Cyclops Blink and credential theft tooling.
Eduard Kovacs
2026.07.30
98% relevant
This article is a direct update on the same event, adding that Cisco released patches for the actively exploited zero-day, described it as a static-credential issue enabling unauthenticated login to a low-privilege account, said exploitation was seen in July, and noted CISA added the flaw to KEV with an August 1 deadline for federal agencies.
info@thehackernews.com (The Hacker News)
2026.07.30
98% relevant
This is the same underlying event: active exploitation of Cisco Secure Firewall Management Center zero-day CVE-2026-20316. The article reinforces that the bug involves static credentials and could expose sensitive data, updating defenders on impact and urgency.
Lawrence Abrams
2026.07.29
100% relevant
This article appears to establish a distinct new tracked event: active zero-day exploitation of Cisco Secure FMC static credentials flaw CVE-2026-20316, alongside updated Cisco guidance for related FMC bug CVE-2026-20079.