CISA Adds Cisco FMC Hard-Coded Password Flaw (CVE-2026-20316) to KEV

CISA placed CVE-2026-20316 into its Known Exploited Vulnerabilities catalog on 2026-07-29. The catalog entry addresses a hard-coded password weakness found in Cisco Secure Firewall Management Center.

Cisco FMC contains a hard-coded password vulnerability. The product, previously called Firepower Management Center, reportedly includes a use of hard-coded password vulnerability. This could reportedly allow an unauthenticated remote attacker to access an affected device with a low-privileged account and reach sensitive data on impacted systems.

The issue is tracked as CVE-2026-20316 and maps to CWE-259. Whether the flaw has been used in ransomware campaigns remains unknown.

The flaw is listed in the KEV catalog. CISA added the Cisco vulnerability on 2026-07-29. Federal agencies must complete remediation by the due date of 2026-08-01.

Required actions focus on vendor mitigations and BOD 26-04 compliance. Agencies must apply mitigations according to vendor instructions while meeting CISA’s BOD 26-04 guidance on prioritizing security updates based on risk and the agency’s Forensics Triage Requirements. For cloud deployments, organizations should follow the applicable BOD 26-04 rules or stop using the product when mitigations cannot be implemented. Each organization remains responsible for assessing internet exposure of every asset and complying with BOD 26-04 patching requirements.

Official resources provide further details. Cisco published its advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh. Further references appear in the BOD 26-04 directive, its implementation guidance, and the NVD entry for CVE-2026-20316.