Vulnerabilities
Cisco FMC Vulnerability: Static Credentials Let Remote Attackers Bypass Auth
A high‑impact flaw in Cisco Secure Firewall Management Center (FMC) lets attackers log in to the web interface using built‑in low‑privileged static credentials. The unauthenticated exploit exposes sensitive data and can be combined with other FMC bugs to elevate privileges. Cisco has issued patches; no workaround exists. CVE‑2026‑20316.
A newly disclosed vulnerability in Cisco Secure Firewall Management Center (FMC) allows a remote, unauthenticated attacker to log in via the web interface using a low‑privileged static account. Once authenticated, the attacker can read sensitive data and potentially chain the flaw with other FMC weaknesses to gain higher privileges.
Key Facts
- Impact: High (SIR). Exposes sensitive data and can be leveraged for privilege escalation.
- Exploitability: Remote, no authentication required to reach the web UI.
- Workaround: None. The only mitigation is applying the vendor’s patch.
- Mitigation: Install the latest FMC software update that removes the static credentials. If the management interface is not exposed to the internet, the attack surface is reduced.
- CVE: CVE‑2026‑20316
“Cisco has assigned this advisory a Security Impact Rating of High, reflecting the potential for privilege escalation when combined with other FMC vulnerabilities.”
Recommended Action
- Verify the FMC version and apply the latest patch immediately.
- Review firewall management access controls and ensure the web interface is not publicly reachable.
- Monitor for any unusual authentication attempts or data access patterns.
Related vulnerabilities
Cisco ISE 802.1X Session Hijack & Info Leak Vulnerabilities – Unauthenticated Local Attackers Can Bypass Auth
Cisco’s Identity Services Engine (ISE) now contains two medium‑risk flaws that let a local, unauthenticated user hijack an 802.1X session or pull sensitive data. The bugs, tracked as CVE‑2026‑20071 and CVE‑2026‑20072, expose attackers to authentication bypass and information disclosure. Cisco has issued patches; no workarounds exist. Systems must be updated promptly.
Read briefing
Microsoft Excel CVE‑2026‑68794 Remote Code Execution Vulnerability
Microsoft has confirmed a remote code execution flaw in Excel (CVE‑2026‑68794) that could let attackers run arbitrary code via a crafted spreadsheet. Defenders should monitor for patches, restrict macro execution, and enforce least‑privilege handling of Office files.
Read briefing
Cisco Finesse Remote File Inclusion Vulnerability (CVE‑2026‑20175) – Unauthenticated Browser Exploit
Cisco Finesse now contains a remote file inclusion flaw that lets attackers inject arbitrary files into a user’s session via crafted HTTP requests. The weakness arises from insufficient input validation, allowing unauthenticated, remote attackers to load malicious scripts into the browser and steal data. Cisco has released patches; no workarounds are available, so affected systems must be updated immediately.
Read briefing
Cisco Contact Center SSRF Vulnerability (CVE‑2026‑20314) Requires Authenticated Access
Cisco’s Packaged and Unified Contact Center Enterprise (CCE) software contains a server‑side request forgery flaw that can be leveraged by anyone who has valid credentials on the system. The defect arises from lax validation of HTTP requests, allowing attackers to instruct the affected device to issue arbitrary outbound traffic. Cisco has released patches to fix the issue; no workarounds are available. Organizations running CCE must apply the update immediately to stop potential internal network reconnaissance and data exfiltration.
Read briefing