Cisco built a password into its own firewall management software. Not a default password an admin forgot to change. A password baked into the code itself, the same for every deployment. Attackers found it. They’ve been using it since at least July.

CISA added the flaw, tracked as CVE-2026-20316, to its Known Exploited Vulnerabilities catalog this week. Federal agencies now have until August 1 to patch. That’s barely any runway at all.

What is CVE-2026-20316? A hardcoded, static credential built into Cisco Secure Firewall Management Center software. It lets an unauthenticated attacker, anywhere on the internet, log in with a low-privilege account. From there, they can pull sensitive configuration data, security policies, and event logs.

A Password Nobody Can Change

This isn’t a case of weak credentials or a forgotten default. The password lives inside the software itself, tied to a built-in account that ships with every FMC installation. CWE-259 is the formal name for this class of bug: hard-coded credentials.

An attacker doesn’t need network access behind a firewall to use it. Anywhere on the internet works, as long as the FMC web interface is reachable. Log in, and the account’s built-in permissions come along with it. Nothing about the account requires guessing a password or phishing an employee.

A Second, Worse Flaw Sits Right Next To It

Cisco disclosed a sibling vulnerability alongside this one, tracked as CVE-2026-20079. Its CVSS score hits a perfect 10.

The flaw comes from a system process created incorrectly when FMC boots up. A crafted HTTP request can bypass authentication entirely, no account needed at all. From there, an attacker runs commands as root.

Cisco hasn’t confirmed active exploitation of that second flaw, only the first. Both share the same hotfix, though. They also leave the same trace behind: a log entry mentioning /var/tmp/license.tmp inside /var/log/messages. Cisco hasn’t explained whether the two vulnerabilities are connected under the hood. The shared fingerprint suggests they might be.

A One-Day Deadline For Federal Agencies

Cisco’s own advisory says its security team first learned of active exploitation in July. That timeline fits a broader pattern this year. Network security appliances themselves keep turning into the attack surface, not just the thing defending it.

CISA’s binding directive gives federal civilian agencies until August 1 to apply the fix. For a flaw like this, that’s an unusually tight window. Cisco has released hotfixes for every affected version, spanning FMC 7.0 through 10.0. There’s no workaround available otherwise. CISA’s fallback advice for anyone who can’t patch in time is blunt: stop using the product until you can.

Firewall management consoles sit in a strange spot. They’re built to secure everything behind them. Yet they need their own scrutiny, like any other piece of software on the network. A password nobody can change is exactly the kind of assumption that scrutiny is supposed to catch.

Conclusion: When the Firewall Manager Ships With a Password Nobody Can Change

A hardcoded credential inside firewall management software changes the nature of credential risk.

No phishing, password spraying, or administrator mistake is required. If the vulnerable management interface is reachable, the weakness is already present. The attacker does not need to discover a password. The software supplies it.

That matters because Firewall Management Center does not protect a single application. It holds security policies, configuration data, event history, and administrative visibility across the firewall environment. Unauthorized access to the management plane can give an attacker information about how the network is defended and where those defenses may be weakest.

The adjacent unauthenticated root-access flaw raises the stakes further. A system designed to manage security policy can itself become a path to privileged control.

Why This Threat Matters

This is not an ordinary password-management failure. The credential is part of the product and cannot be corrected through normal account hygiene.

• The vulnerable account is built into the software.
• No employee interaction is required.
• An internet-reachable management interface expands the attack surface.
• Low-privilege access can expose configurations, policies, and event data.
• Security configuration data can help an attacker understand network trust paths and defensive coverage.
• A related authentication bypass can allow command execution with root privileges.
• Exposure reduction may lower immediate risk, but it does not remove the vulnerable code.
• Hotfix deployment and compromise review must be treated as separate operational tasks.

A firewall can continue filtering traffic while its management plane is already exposing information an attacker can use. Device availability alone is not evidence that the security architecture remains trustworthy.

Where Xcitium Changes the Outcome

The primary response is vulnerability remediation.

Xcitium Vulnerability Assessment helps organizations identify exposed management services, vulnerable software versions, missing security updates, and remediation gaps within the supported assessment scope.

For this attack class, visibility must produce immediate action:

• Apply the vendor hotfix.
• Remove the management interface from public internet reach.
• Restrict administration to dedicated management networks and approved sources.
• Inspect available logs for vendor-published indicators.
• Review configuration changes and administrative activity.
• If compromise is suspected, rotate affected credentials, keys, and certificates.
• Validate firewall policies and managed-device configurations against known-good records.

Reducing exposure is important, but it is not the same as fixing the vulnerability. A management interface moved behind a trusted network can still be reached through a compromised administrator system or an abused remote-access path.

That is where Execution Governance becomes relevant.

On managed administrator workstations, security jump servers, maintenance systems, and other supported endpoints that administer the firewall environment, Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform, governs unknown execution before trust exists.

Unknown scripts, payloads, remote tools, and post-exploit utilities do not receive unrestricted access to real system resources simply because they were launched from a trusted administrator session.

Code can run without being able to cause damage.

EDR detects execution. Xcitium governs execution.

This does not patch Cisco FMC or directly protect the appliance operating system. It adds architectural enforcement around the managed systems attackers may use to administer the security stack, reuse exposed information, or expand access after the initial breach.

Patch the Manager. Govern What Can Use It.

Security infrastructure must be assessed with the same discipline applied to the systems it protects.

Inventory every firewall management deployment.

Remove unnecessary public exposure.

Apply the vendor hotfix without treating network restriction as permanent remediation.

Inspect for compromise before assuming the update closed the incident.

Rotate credentials and cryptographic material when exploitation is suspected.

Validate policies against known-good configurations.

Govern unknown execution on every managed system with administrative access to the firewall environment.