Cisco Firewall Zero-Day Under Active Exploit, CISA Warns

The U.S. Cybersecurity and Infrastructure Security Agency added a Cisco Secure Firewall Management Center vulnerability to its Known Exploited Vulnerabilities catalog Wednesday, confirming active exploitation in the wild.

The flaw, tracked as CVE-2026-20316 with a CVSS score of 5.3, permits unauthenticated remote attackers to log into affected systems. The vulnerability stems from static credentials embedded in the FMC software—a design flaw that bypasses normal authentication controls. CISA's KEV listing triggers mandatory patching deadlines for federal agencies and signals elevated risk for private sector operators using the platform.

Cisco Secure Firewall Management Center is deployed widely across enterprise and government networks to centrally manage firewall policies and security posture. The zero-day designation indicates adversaries were exploiting the flaw before Cisco disclosed it publicly, compressing the window for defensive action.

• 01Federal agencies face binding patch deadlines under CISA directive; non-compliance risks audit findings.
• 02Enterprises using Cisco FMC should assume reconnaissance or compromise attempts are underway.
• 03Incident response teams must audit FMC access logs for anomalous authentication events.
• 04Supply chain and managed service providers relying on FMC face downstream client exposure.