Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.
The vulnerability is caused by static credentials for a low-privilege account built into Cisco Secure FMC Software.
Cisco says an unauthenticated, remote attacker can use these credentials to log in to an affected system and access sensitive data available to the account.
While CVE-2026-20316 has a CVSS score of 5.3, Cisco assigned it a High severity rating because the access can be combined with other FMC vulnerabilities to elevate privileges.
However, the company has not identified the additional vulnerabilities or explained how they are being used in attacks.
