Cisco's Baked-in Passwords Exposed Again

Cisco's Secure Firewall Management Center (FMC) has been breached by attackers this year, according to a September report from Cisco's Talos team. The intruders used CVE-2026-20316, a set of static credentials, which is another way of saying the password shipped inside the product.

The flaw was attributed to static credentials for a low-privileged account in the FMC web interface. Cisco rates it high because that login can be chained with other FMC bugs to gain more privilege.

CISA cited evidence of active exploitation when it added the bug to its Known Exploited Vulnerabilities (KEV) catalog, and The Hacker News reported that it had been exploited as a zero-day.

This is not an isolated incident. Cisco has a pattern of shipping hard-coded credentials in its products. In 2018 and again in 2021, the company warned about earlier hard-coded password bugs.