Security · 1h ago
Cisco FMC Zero-Day Exploited via Static Credentials, Root Access Achieved
Attackers are actively exploiting CVE-2026-20316, a static credential flaw in Cisco Secure Firewall Management Center, to gain low-privilege access. They then chain it with another vulnerability to escalate to root, compromising management credentials and keys. Cisco has confirmed zero-day attacks and urges immediate patching and forensic review for license.tmp execution traces.
Meridian48 take
The real story is the chained exploitation: static credentials alone are bad, but the ability to pivot to root and then to managed firewalls makes this a critical supply-chain risk for enterprises.
Read the full reporting
Cisco FMC CVE-2026-20316: Active Exploitation Chain from Static Credentials to Management Infrastructure Compromise →
DEV Community
cisco-fmczero-day-exploitation