Hardcoded Credential Exploited in Cisco Secure Firewall Management Center
NEOSEC enrichment — no mirror of the original source
Cisco has published a security advisory urging users to update Cisco Secure Firewall Management Center (FMC) software to fix a static credential vulnerability that is under active exploitation. CVE-2026-20316 allows an unauthenticated remot
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Dukes, Honan, Murray, Neely, Pescatore, Ullrich.
Linked advisories
- CVE-2026-20316Cisco Secure Firewall Management Center (FMC) — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
- CVE-2026-20316Cisco Secure Firewall Management Center: Schwachstelle ermöglicht Offenlegung von Informationen
- CVE-2026-20316Cisco Secure Firewall Management Center (FMC): hartcodiertes Passwort
Affected vendors and products
More on Credential
Other advisories
- Highghsa:GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Not ratedosv:GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
- Not ratedosv:CVE-2026-116819OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
- Not ratedosv:CVE-2026-94386Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
- Not ratedosv:CVE-2026-77056Use of Default Credentials in boneIO
- HighCVE-2026-77056boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documente…
- Not ratedosv:CVE-2026-116197Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection
- Not ratedosv:CVE-2026-116196Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
Other news entries
- Tailscale warns of SSH flaws allowing root privilege escalationNewsBleepingComputer
- 'Gheist' Weaponizes GitHub Tokens to Steal Cloud SecretsNewsDark Reading
- Bubble says an attacker accessed users' third-party API keys and tokens in an active security incidentBreachpwn.watch
- Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 CredentialsNewsThe Hacker News
- Disgraced eMudhra drops out of TLS business after using cert private key of 4NewsArs Technica — Security
- LiteLLM release pipeline hacked to distribute info-stealer malwareNewsBleepingComputer
- Machine speed attacks require machine speed detection and responseNewsBleepingComputer
- LiteLLM release pipeline hacked to distribute credential-stealing malwareNewsCSO Online
ID