Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation. The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log

The article reports that CISA has added a newly disclosed Cisco Secure Firewall Management Center (FMC) vulnerability, CVE-2026-20316, to its Known Exploited Vulnerabilities catalog after confirmation of active zero-day exploitation, enabled by static low-privilege credentials that allow unauthenticated remote login and access to sensitive data.[2] Cisco has released hotfixes and IoC guidance, urging customers to check logs for evidence of compromise.[2] From a RealGround perspective, this demonstrates how weaknesses in core network security and management software can cascade into AI environments that depend on those networks, logging systems, and identity infrastructure, creating indirect paths to AI system compromise or data leakage. Organizations operating AI agents or models on infrastructure managed or protected by Cisco FMC should treat this as a critical AI supply-chain risk and ensure timely patching, SBOM-based dependency tracking, and continuous monitoring of management-plane exposures.