SURIQ
A CVSS score of 5.3 usually buys a bug a spot in next month's patch cycle. This one is on CISA's must-patch list because attackers are already using it. CVE-2026-20316 is a fixed, built-in password inside Cisco Secure Firewall Management Center, the console that centrally manages Cisco firewalls, and Cisco rated it High severity despite the middling score. The gap between those two numbers is the whole story.
Cisco went public on July 29, 2026, the same day CISA moved the flaw onto its Known Exploited Vulnerabilities list. The finder was Jimi Sebree of Horizon3.ai. Federal civilian agencies have until August 1, 2026 to close it, per CISA's directive. If you run this console, treat that date as a floor.
A password that ships with the box
The bug is old-fashioned. A low-rights account inside the console web interface carries a password that is the same on every install, and anyone who reaches the login page can sign in as that account without authenticating, then read data it should not expose. That is the finding in Cisco's advisory. No stolen credential, no phishing, no chain for the first step. The password is in the product. The CVE record files it under CWE-259, a hard-coded password.
Exposure changes the math. Cisco and NVD both point out that a management interface with no path to the public internet is far less reachable. True, and it is the first thing to verify: a firewall console answering on the open internet is precisely what an attacker is banking on.
Why a medium-scored bug landed on the must-patch list
Cisco pinned a High Security Impact Rating on it rather than the Medium the 5.3 implies, and named the reason: this foothold becomes a lever when paired with other holes in the same product. The score measures the way in. It says nothing about the room on the other side of the door.
The room is likely CVE-2026-20079, a separate flaw Cisco documented in the same window. Rated CVSS 10.0, it is an authentication bypass that can reach root by running scripts on the box, per reporting from The Hacker News. Cisco has stated it has seen no signs of that second flaw being abused. Yet both advisories carry the identical marker of a break-in, and BleepingComputer noted the overlap hints the pair may be run together. Judging CVE-2026-20316 by its 5.3 is the error. A low-rights way into the machine that governs your firewalls is worth exactly what sits behind it.
Cisco shipped hotfixes for six release trains, from 7.0 through 10.0. Line your version up against the fixed build:
| Affected release | Fixed in (hotfix) |
|---|---|
| 7.0 | 7.0.9.1-3 |
| 7.2 | 7.2.11.1-4 |
| 7.4 | 7.4.7.1-3 |
| 7.6 | 7.6.5.1-2 |
| 7.7 | 7.7.12.1-2 |
| 10.0 | 10.0.1.1-2 |
How to tell if someone already walked in
This was a zero-day, exploited before a fix existed, so installing the hotfix is necessary but not enough. Patching a machine that is already owned only bolts the door with the intruder inside. Before you trust a Firewall Management Center appliance again, confirm nobody has been in.
Cisco gave defenders one thing to hunt, and it covers both CVEs. From expert mode, read the device system log at /var/log/messages and look for any mention of /var/tmp/license.tmp. If it appears, assume the appliance is dirty. Cisco's own guidance is then to rotate every user credential, cryptographic key, and certificate, and to open a recovery case with Cisco TAC. That is a compromise check, not a patch check, and it is the step most teams will skip.
Appliance intrusions like this stay quiet and rarely fire a routine alert, which is why continuous log hunting across your security gear beats trusting the version sticker on the box. One log line separates a patched device from a patched device that still belongs to someone else.
Patch the console, then prove it wasn't already opened
Four steps, in order:
- Check exposure first. The Firewall Management Center interface has no business facing the internet. If it does, lock that down ahead of everything else.
- Install the hotfix for your train. Cisco lists no mitigation short of the update. Match your version to the fixed build in the table.
- Hunt the shared marker before you trust the box. If
/var/tmp/license.tmpturns up in the log, rotate credentials, keys, and certificates and file a case with Cisco. - Beat the clock. The federal cutoff is August 1, 2026. Even outside government, that is a fair ceiling for a firewall management flaw already under attack.
Baked-in and default passwords keep surfacing in the very gear meant to guard the network. This year alone it showed up in Check Point's SmartConsole, in self-hosted UniFi controllers, and in exposed server management interfaces. Same lesson as the recent Cisco Unified CM flaw: the management plane is the soft underbelly, and a vendor's own default account is one of the surest ways in. Vulnerability management has to cover the tools you trust most, right beside the servers they watch.