CISA Orders Emergency Patching For Cisco FMC Zero-Day Exploited Through Static Credentials

A newly disclosed vulnerability in Cisco Secure Firewall Management Center is being actively exploited in attacks, prompting the US Cybersecurity and Infrastructure Security Agency to order federal agencies to apply emergency fixes within days.

Tracked as CVE-2026-20316, the vulnerability allows an unauthenticated remote attacker to sign in to an affected Firewall Management Center, or FMC, appliance using static credentials associated with a low-privilege account. Once authenticated, the attacker may access sensitive information available to that account and potentially use the foothold alongside other vulnerabilities to gain broader control of the management system.