On 29 July, CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog: a hardcoded credential built into Cisco Secure Firewall Management Center (FMC), the on-premises console that administrators use to configure, monitor and push policy to their actual Cisco firewalls. Horizon3.ai's technical writeup, credited to researcher Jimi Sebree, confirms Cisco rated the flaw 8.9 on the CVSS scale and that active exploitation was already underway by 30 July. Federal civilian agencies were given until 1 August to remediate - a three-day window, the kind CISA reserves for flaws it has confirmed are actively being used against real targets, not a theoretical worst case.
A password that was never supposed to be a secret an attacker needed to guess
Most authentication bypass stories involve an attacker finding a flaw in the logic that checks a password. This one is different, and in some ways plainer: the credential was never a secret to begin with. CVE-2026-20316 is a hard-coded, static account present on every install of the affected software branch - the same username and password on your FMC as on the next customer's, and the one after that, because it shipped that way from the vendor. Cisco's own advisory frames the mitigating factor honestly: exposure depends on whether the FMC management interface is reachable from the public internet. Plenty of them are, because a management console you can only reach from inside the network is also one that's harder for a distributed IT team to administer - and that operational convenience is exactly what turns a hardcoded credential from an embarrassing oversight into an active exploitation vector.
The account itself only grants low-privilege access to the FMC web interface, which is the detail Cisco's advisory leads with and the detail that matters least in practice. The Cyber Express's coverage notes that low-privilege access to FMC is still access to sensitive information the platform stores and manages, and that Cisco itself warns the credential can be chained with other, separately disclosed FMC vulnerabilities to escalate further. A management platform that administers every firewall underneath it is not a system where "low privilege" is a comforting phrase. It's a foothold, and footholds on the management plane of network security infrastructure have a well-established habit of turning into full compromise once an attacker has time and a second bug to chain it with.
The affected list is wide, and the fix requires an actual upgrade
Cisco's hot fixes cover the 7.0, 7.2, 7.3, 7.4, 7.6, 7.7 and 10.0 branches, released through Cisco Software Center. There is no configuration workaround that removes the account - the credential is baked into the software itself, which means the only complete remediation is upgrading to a fixed release, not adjusting a setting. That's a meaningfully bigger lift for a lot of security teams than a config change, and it's the reason CISA's three-day window matters: patching a management-plane appliance usually means a change window, a rollback plan and a maintenance call with whoever depends on that firewall staying up, none of which happen instantly even when a team wants them to.
The pattern this keeps confirming
This is the third time in as many weeks we've covered a critical, unauthenticated flaw landing specifically on the management plane of network or security infrastructure rather than the systems that plane is meant to protect. We wrote about Check Point's SmartConsole authentication bypass, which let attackers log in as admin with no password at all, and about Arista's VeloCloud Orchestrator command injection flaw, which scored a perfect 10 for severity. None of these three vendors are careless by industry standards - Cisco, Check Point and Arista all run serious security programmes. What they share is a product category: software whose entire job is administering other security infrastructure, which makes its own authentication the single highest-value target in the whole deployment, and apparently still not always treated with the paranoia that value deserves. A hardcoded account is a basic software supply chain failure, the kind a credential-scanning step in a release pipeline should catch before it ships anywhere near a customer.
- Patch Cisco Secure FMC now if you run an affected branch - there is no workaround, and CISA's three-day federal deadline reflects confirmed active exploitation, not caution.
- Audit whether your FMC management interface is reachable from the public internet, and if it is, restrict it regardless of patch status - Cisco's own advisory names this as the deciding factor in exposure.
- Review FMC access logs for authentication from the built-in account or from unexpected source addresses, using the indicators of compromise researchers have already published.
- Treat any hardcoded or default credential finding in management-plane software as a full-compromise risk, not a low-severity footnote, given how readily these get chained with other bugs on the same platform.
- Extend this audit beyond Cisco - ask every network and security vendor whose console you rely on whether any account, credential or debug interface ships identically across customer installs.
Three vendors, three management-plane flaws, three weeks - that's not a coincidence worth ignoring, it's a category of risk that keeps landing in the same place because the same incentive keeps producing it: build the tool that manages the security, worry about that tool's own authentication last. If you can't currently say with confidence which of your own network and security management interfaces are internet-reachable, that's the gap worth closing before the next one of these lands. Email sales@halfteck.com if you'd like help running that audit.