Published Wednesday, July 29, 2026 at 04:03 PM PT

<strong>DEVELOPING — Cisco Firewall Management Center Static Credential Zero-Day Under Active Exploitation</strong>

BLUF: Cisco has disclosed a zero-day vulnerability in Firewall Management Center (FMC) involving hardcoded or static credentials. The flaw is confirmed under active exploitation by attackers. Organizations running Cisco FMC must audit credential exposure immediately and monitor for unauthorized access. CVE and detailed patch timeline not yet confirmed in available source material.

DETAILS

  • Vulnerability type: Static credential flaw in Cisco Firewall Management Center (FMC) — the management console for Cisco’s firewall fleet
  • Exploitation status: Confirmed zero-day; attackers are actively exploiting the vulnerability in the wild
  • Attack vector: Static or hardcoded credentials likely enabling unauthorized console access and potential lateral movement
  • Cisco advisory: Cisco has publicly warned of the flaw; exact CVE ID, affected versions, and CVSS score not available in current reports
  • Incident timeline: Exploitation ongoing; patch release date and remediation guidance pending full Cisco advisory

IMPACT

  • Primary targets: Organizations managing Cisco firewall infrastructure via FMC
  • Scope: Any FMC instance exposed or accessible via the credential vector; risk includes unauthorized management access, firewall rule manipulation, and potential network-wide compromise
  • Severity assessment: High — static credentials in firewall management plane bypass authentication controls and grant full policy/traffic control access

RECOMMENDED ACTIONS

  1. Immediate: Audit FMC credential inventory; verify no hardcoded/static credentials are in use or exposed in configurations, backups, or logs
  2. Monitor: Watch for unauthorized FMC logins, policy changes, or rule modifications; enable logging if not already active
  3. Isolate if possible: Restrict FMC management access to known administrator IPs while details emerge
  4. Watch for Cisco advisory: Await CVE assignment, affected version list, and official patch timeline from Cisco security notices
  5. Prepare patches: Stage Cisco FMC updates for rapid deployment once advisory is released

SOURCES

  • BleepingComputer (Cisco FMC zero-day warning)
  • Related: Recent Cisco Unified CM (CVE-2026-20230) and SD-WAN zero-days confirm active targeting of Cisco management infrastructure

STATUS: Information is developing. This alert will be updated with CVE details, affected versions, and patch timeline as Cisco releases additional guidance.

Recent high-severity events at publish time:

Recent high-severity events