Our automated tracking framework flagged that CISA added CVE-2026-20316 (Cisco Secure Firewall Management Center (FMC)) to the Known Exploited Vulnerabilities (KEV) catalog on July 31, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-20316 by August 1, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-20316 |
| Vendor / product | Cisco Secure Firewall Management Center (FMC) |
| Vulnerability | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| CVSS base score | 5.3 |
| Added to KEV | July 29, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | August 1, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Cisco currently ranks #8 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 95 |
| Median lag (public → KEV listing) | 1245 days |
| 0-day rate (exploited at or before disclosure) | 14% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1656 tracked KEV entries is 273 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2008-4128 | IOS | July 13, 2026 | 6507 | No |
| CVE-2026-20230 | Unified Communications Manager | June 25, 2026 | 22 | No |
| CVE-2026-20262 | Catalyst SD-WAN Manager | June 15, 2026 | 0 | No |
| CVE-2026-20245 | Catalyst SD-WAN Manager | June 9, 2026 | 5 | No |
| CVE-2026-20182 | Catalyst SD-WAN | May 14, 2026 | 0 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-20316, a hard-coded password vulnerability in Cisco Secure Firewall Management Center (FMC), to its Known Exploited Vulnerabilities (KEV) catalog. Rated with a CVSS base score of 5.3, this flaw presents a critical immediate patching requirement, particularly for federal agencies facing an August 1, 2026 deadline. Organizations leveraging Cisco FMC are directly exposed and should prioritize patching immediately given the confirmed in-the-wild exploitation.
The addition to the KEV catalog on July 29, 2026, with a ‘0 days public before KEV listing’ metric, indicates that active exploitation was detected extremely rapidly, potentially even before public disclosure. This zero-day observation signals that adversaries were quick to weaponize this vulnerability. Cisco’s historical median lag for KEV entries is significantly longer (1245 days), making this immediate KEV listing highly unusual and indicative of an urgent, active threat rather than a slowly maturing exploit.
While no ransomware use is currently known, the rapid exploitation necessitates immediate action. If patching isn’t feasible by the federal deadline, implementing robust compensating controls is essential. This includes isolating affected FMC instances, strictly limiting network access to trusted administrators only, and enhancing monitoring for unusual activity originating from or targeting the device. Proactive threat hunting for any signs of compromise within the environment is also strongly recommended.
Related Coverage
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
