A Password Was Built Into Cisco's Firewall Manager. It Is Being Exploited, and Agencies Had Three Days to Fix It

On 29 July, CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalogue and gave federal civilian agencies until 1 August to deal with it. Three days.

The flaw is a password built into the software. Cisco Secure Firewall Management Center — the console administrators use to run their firewall estate — ships with static credentials for a low-privileged account, and an unauthenticated attacker who reaches the appliance over the network can log in with them. Cisco says there is no workaround.

The vulnerability scores 5.3 out of 10. On the usual reading, that is a medium.

What the score measures, and what it leaves out

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The first half is ugly: network reachable, low complexity, no privileges, no user interaction. The second half is what holds the score down — low confidentiality impact, and none at all on integrity or availability.

The built-in account is low-privileged. An attacker using it cannot, on Cisco's account, change the configuration or take the appliance down. They can read.

The score is defensible on its own terms.

Cisco does not agree with its own number

Cisco assigned the flaw a High Security Impact Rating anyway, over the top of its own medium CVSS score. The vendor's stated reason is that the flaw "can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges".

That reframes it. The account gets an attacker in; its value is as a foothold for chaining. CVSS scores a vulnerability in isolation, and this one is only modest in isolation — in a chain with a second FMC flaw it becomes the unauthenticated foothold that the rest of the chain needs. As the March entry below shows, second FMC flaws are real.

Cisco also notes that exposure falls sharply where the management interface has no public internet connectivity, which is the single most useful sentence in the advisory for anyone triaging this.

The box matters more than the bug

Firewall Management Center is not a firewall. It is the management plane — where policy, the rule base and an organisation's segmentation all live in one place. Read access to that is read access to the map.

Even read access has value here. An attacker who learns the segments, the permissive rules and where the gaps sit has done weeks of reconnaissance without the noise. CVSS scores impact on the system that holds the flaw; it has no field for the fact that this particular system knows where everything else is.

There is also a gap in the advisory worth naming. Cisco describes the built-in account as low-privileged but does not enumerate what it can actually read. For a defender, the whole question is whether that account sees a version banner or the rule base — and the advisory does not say.

CISA marked this one for forensics

Alongside the patching instruction, this catalogue entry invokes the agency's Forensics Triage Requirements — the language used when the working assumption is that access may already have happened. Agencies were not told to patch. They were told to patch and then go and look.

That language is not attached to everything. Of the 172 vulnerabilities added to the catalogue in 2026, 39 carry it; 125 carry the older standard wording that points at BOD 22-01 and asks only for mitigation. The first entry to carry the triage requirement was added on 11 June, so this is a recent tightening rather than a long-standing practice.

The two designations are not the same judgement. Sixty-seven of this year's entries carry a deadline of three days or fewer, but only 34 of those also carry the triage requirement — and five entries were given the triage requirement alongside a longer fourteen-day window. Speed and suspected compromise are being decided separately.

What makes this entry notable is that the published guidance on BOD 26-04 describes mandatory forensic triage as the tier reserved for vulnerabilities yielding total system control on internet-facing assets. A low-privileged read is not total control. Either the requirement is being applied more broadly than the guidance describes, or CISA thinks this read access matters more than the CVSS vector shows. The catalogue does not clarify, and we cannot resolve it — but either way it aligns with the three-day deadline.

How unusual this class of bug is

Hard-coded credentials feel like a 2005 problem, and the catalogue supports that instinct. Of the 1,656 vulnerabilities CISA has ever confirmed as exploited, ten carry a hard-coded or embedded credential weakness. Two carry CWE-259 specifically, the code for a hard-coded password: this one, and a Zoho ManageEngine flaw catalogued in March 2023.

Embedded credentials are rarely found and exploited these days, so when one turns up it is usually in a product nobody expected to be scrutinised that closely. The other pattern is where they appear: Cisco's firewall console, Fortinet's FortiOS, D-Link storage and the EyesOfNetwork monitoring platform are four of the ten — products bought to run or protect a network, not ordinary applications.

Cisco's position in the catalogue

Cisco is the second most-represented vendor in the KEV catalogue, with 95 entries. Only Microsoft, at 382, appears more often, and Microsoft's share reflects a desktop and server estate installed almost everywhere. Cisco's reflects network equipment.

This is also the second Firewall Management Center entry of 2026. CVE-2026-20131, a deserialization flaw in the same web management interface, was catalogued on 19 March, also with a three-day clock. Different weakness, same appliance, four months apart.

Thirteen Cisco vulnerabilities have entered the catalogue this year. Ten of them carried a deadline of three days or fewer.

Three days is the new normal

For most of the catalogue's life the standard remediation window was 21 days. Across the 172 entries added in 2026, the most common window is three days, applied to 65 of them; another two were given two days and one was given five. Taken together, a window of three days or fewer now covers more of this year's additions than the old 21-day standard does — the shape of a tightening that was already under way before BOD 26-04 formalised it.

A three-day window is short enough that the calendar starts to matter. This one ran Wednesday to Saturday, which is three calendar days but closer to two working ones.

What the deadline does not cover

BOD 26-04 binds United States federal civilian agencies. It does not bind anybody else, and the catalogue is not a regulation for private operators anywhere. Outside government it stays valuable as the most reliable public list of vulnerabilities actually seen in use, rather than the much longer list of those that merely exist.

The appliance does not know which network it is on. An organisation outside the directive's scope running an unpatched Firewall Management Center has the same exposure as an agency inside it, and no deadline.

What to do

Cisco has published hot fixes for each affected release train. There is no configuration change that helps, and the advisory does not offer a way to disable the account.

Two things are worth doing beyond applying the fix. Establish whether the management interface was reachable from an untrusted network, because that is what converts this from a defect into an incident. And follow CISA's lead on triage: Cisco's PSIRT became aware of exploitation in July, before a fix existed, so an appliance patched this week may have been reachable for some period while the flaw was being used.