CISA KEV · catalog date Jul 29, 2026 · first observed Aug 1, 2026
Evidence dossier
CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Exploited in the wild (CISA KEV since Jul 29, 2026). cisco reports CVSS 3.1 5.3. EPSS estimates 9.8% exploit likelihood as of Aug 27, 2026.
59.5–67.9Priority evidence range
As of Aug 27, 2026
Normalized restatement
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
- State
- PUBLISHED
- Published
- Jul 29, 2026
- Updated
- Aug 1, 2026
- Evidence coverage
- 85%
Evidence chronology
What was known when
- Source dateFirst observed by CASCACISA KEVOriginal evidence ↗
Exploitation cataloged: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Inspect raw assertion
- Field
observed_exploitation- Value
- Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
- Source dateSource date omittedFirst observed by CASCACISA-ADPOriginal evidence ↗
Record text: CISA ADP Vulnrichment
Inspect raw assertion
- Field
container- Value
- CISA ADP Vulnrichment
- Source dateSource date omittedFirst observed by CASCAciscoOriginal evidence ↗
Record text: Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Inspect raw assertion
- Field
container- Value
- Cisco Secure Firewall Management Center Software Static Credential Vulnerability
- Source dateFirst observed by CASCAFIRST EPSSOriginal evidence ↗
EPSS score: 9.82% probability · 95.19th percentile
Inspect raw assertion
- Field
model_probability- Value
- Probability 0.098160000000; percentile 0.951890000000
FIRST EPSS · score date Aug 27, 2026 · 95.2th percentile · first observed Aug 27, 2026
cisco · CVSS 3.1 · first observed Aug 1, 2026 · same-version scores align in this snapshot
Evidence detail
Source limits and decisions
Why each evidence state has this value
casca-unknown-reasons-v1Exploitation statusEvidence supported
Eligible evidence is present for this bounded claim.
- Revision
- evidence-policy-v1.1.0
- Cutoff
- Aug 27, 2026
- Resolution
- None
Exploit likelihoodEvidence supported
Eligible evidence is present for this bounded claim.
- Revision
- evidence-policy-v1.1.0
- Cutoff
- Aug 27, 2026
- Resolution
- None
Severity assessmentEvidence supported
Eligible evidence is present for this bounded claim.
- Revision
- casca-direct-cvss-eligibility-v1
- Cutoff
- Aug 27, 2026
- Resolution
- None
Affected productsSource-reported scope
The cited source assertion is retained while canonical product linkage remains open.
- Revision
- casca-factor-d-obligations-v1
- Cutoff
- Aug 27, 2026
- Resolution
- Resolve identity
Source comparison
Who said what
CISA KEVOriginal assertion
Exploitation cataloged
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Inspect raw assertion
- Field
observed_exploitation- Value
- Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
CISA-ADPIndependent enrichment
Record text
CISA ADP Vulnrichment
Inspect raw assertion
- Field
container- Value
- CISA ADP Vulnrichment
ciscoOriginal assertion
Record text
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Inspect raw assertion
- Field
container- Value
- Cisco Secure Firewall Management Center Software Static Credential Vulnerability
FIRST EPSSOriginal assertion
EPSS score
9.82% probability · 95.19th percentile
Inspect raw assertion
- Field
model_probability- Value
- Probability 0.098160000000; percentile 0.951890000000
Applicability
Cited product scope
8 scope groups
cisco · source assertedCiscoCisco Secure Firewall Management Center (FMC)Direct source scope
Affected: 7.0.0Affected: 7.0.0.1Affected: 7.0.1Affected: 7.0.1.1Affected: 7.0.2Affected: 7.2.0Affected: 7.0.2.1Affected: 7.0.3Affected: 7.2.0.1Affected: 7.0.4Affected: 7.2.1Affected: 7.0.5Affected: 7.3.0Affected: 7.2.2Affected: 7.3.1Affected: 7.2.3Affected: 7.2.3.1Affected: 7.2.4Affected: 7.0.6Affected: 7.2.4.1Affected: 7.2.5Affected: 7.3.1.1Affected: 7.4.0Affected: 7.0.6.1Affected: 7.2.5.1Affected: 7.4.1Affected: 7.2.6Affected: 7.4.1.1Affected: 7.0.6.2Affected: 7.2.7Affected: 7.2.5.2Affected: 7.3.1.2Affected: 7.2.8Affected: 7.6.0Affected: 7.4.2Affected: 7.2.8.1Affected: 7.0.6.3Affected: 7.4.2.1Affected: 7.2.9Affected: 7.0.7Affected: 7.7.0Affected: 7.4.2.2Affected: 7.2.10Affected: 7.6.1Affected: 7.4.2.3Affected: 7.0.8Affected: 7.6.2Affected: 7.7.10Affected: 7.2.10.1Affected: 7.0.8.1Affected: 7.6.2.1Affected: 7.2.10.2Affected: 7.7.10.1Affected: 7.4.2.4Affected: 7.4.3Affected: 7.7.11Affected: 7.6.4Affected: 10.0.0Affected: 7.4.4Affected: 7.4.5Affected: 7.0.9Affected: 7.2.11Affected: 7.7.12Affected: 7.6.5Affected: 7.4.6Affected: 10.0.1Affected: 7.4.7
Source-reported scopeCanonical linkage remains open; the cited source assertion is retained below.
Inspect raw assertion
[{"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.0.0.1"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "7.0.1.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.0.2.1"}, {"status": "affected", "version": "7.0.3"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.0.4"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.0.5"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.2.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.0.6"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.0.6.1"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.0.6.2"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.0.6.3"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.0.7"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.0.8"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.2.10.1"}, {"status": "affected", "version": "7.0.8.1"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.7.10.1"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.4.3"}, {"status": "affected", "version": "7.7.11"}, {"status": "affected", "version": "7.6.4"}, {"status": "affected", "version": "10.0.0"}, {"status": "affected", "version": "7.4.4"}, {"status": "affected", "version": "7.4.5"}, {"status": "affected", "version": "7.0.9"}, {"status": "affected", "version": "7.2.11"}, {"status": "affected", "version": "7.7.12"}, {"status": "affected", "version": "7.6.5"}, {"status": "affected", "version": "7.4.6"}, {"status": "affected", "version": "10.0.1"}, {"status": "affected", "version": "7.4.7"}]NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 7.0.0; end including 7.0.9NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 7.2.0; end including 7.2.11NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 7.3.0; end including 7.3.1.2NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 7.4.0; end including 7.4.7NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 7.6.0; end including 7.6.5NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 7.7.0; end including 7.7.12NVD · source assertedVendor unspecified by sourceProduct unspecified by sourceDirect source scope
Version bounds not stated
Scope supportedInspect raw assertion
cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*; start including 10.0.0; end including 10.0.1Affected-product evidence
Accepted scope and product mapping
0 canonical links · 2 source-reported links
Canonical linkage remains open; the cited source assertion is retained below.
Vendor specified only by source · Product specified only by source
- Source class
- Direct cve affected
- Assertions
- 1
- Mapping revision
- cpe23-exact-mapping-v1
- Observed cutoff
- Aug 27, 2026
Retained assertion IDs
922999f9-d5fc-40fc-8498-60de9aefad52Canonical linkage remains open; the cited source assertion is retained below.
Vendor specified only by source · Product specified only by source
- Source class
- Nvd cpe vulnerable target
- Assertions
- 7
- Mapping revision
- cpe23-exact-mapping-v1
- Observed cutoff
- Aug 27, 2026
Retained assertion IDs
08c76f3a-fce9-49ef-8559-9829f2311cc035319fec-e4ad-4773-b86b-66861e908ed24ba5e144-f90e-45f7-be89-ab37543649ff55464241-51c7-497b-a600-ef642311acef85bdb3dd-89fa-4577-becc-efcd1ea512bb98df8e6f-9c59-417e-b6a6-309391936760a1aacb7c-c4a3-4aec-8f53-4f3173a12502Assessments
CVSS by origin
psirt@cisco.comCVSS 3.1 · role Secondary · priority eligiblevalid_match
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NciscoCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibility
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDirect CVE/CNA normalized decisions
5.3Priority eligible
cisco
CVSS 3.1 · Primary · Original assertion · rank 1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Validation
- Valid match
- Recomputed
- 5.3
- Decision reason
- Evidence supported
- Policy
- casca-direct-cvss-eligibility-v1
Assessments are retained side by side under closed precedence. Cascade never averages CVSS.
Evidence boundaries
- KEV membership is authoritative for the catalog, not proof of exposure in any environment.
- EPSS is a dated model probability and not an individual-environment prediction.
- Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
- NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
- Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
- NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
- Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
- OSV aggregation and OSV-converted NVD material are not independent corroboration.
- Red Hat facts are vendor assertions for the exact supplied products.
- Nonmembership and not-yet-observed states are not proof of safety.