The TL;DR

CVE-2026-20316 is a CVSS 5.3 — technically “Medium” — on Cisco Secure Firewall Management Center (FMC). CISA added it to KEV on July 29. The due date was August 1. The vulnerability lets an unauthenticated attacker log in via a low-privileged account and access sensitive data. The low score is misleading: the attack vector is Network, complexity is Low, and no privileges are required.

The Vulnerability

NVD describes it as:

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Three things worth noting:

  1. No authentication required to trigger it. The entry point accepts unauthenticated requests and routes them to a code path that resolves a low-priv user session. That’s unusual — most web auth bypasses require either a valid session cookie or a prior authenticated login.

  2. Confidentiality only. It reads data but doesn’t modify it. No write, no delete, no exec. This is reconnaissance-grade, not exploit-grade — unless the sensitive data is enough for the next step (credentials, topology, API keys).

  3. It’s in KEV. CISA saw active exploitation within days of the advisory. The two-week remediation window was tight.

Why the CVSS 5.3 Is Deceptive

CVSS 5.3 sounds modest. But the vector tells a different story:

  • AV:N — anyone on the internet can hit it (if FMC is exposed)
  • AC:L — no special conditions, no timing window, no user interaction
  • PR:N — unauthenticated
  • UI:N — no victim involvement needed
  • S:U — impacts only the FMC host itself

The reason it’s not 7.5+ is because the impact is Confidentiality Low only. No integrity, no availability.

For a security team running FMC as their primary firewall management plane, this is a real concern. FMC typically holds:

  • Device credentials (firewalls, routers, switches)
  • Network topology maps
  • Policy configurations
  • Log data from thousands of endpoints

A low-priv data dump from FMC can feed directly into lateral movement.

Affected Versions

From the Cisco advisory (published alongside the CVE on July 29):

  • FMC 7.4.x prior to 7.4.250
  • FMC 7.3.x prior to 7.3.270
  • FMC 7.2.x prior to 7.2.370

Most organizations should be on one of these three branches. If you’re on an older branch (7.1 or earlier), check the advisory directly — those branches may have different fix versions.

What To Do

  1. Confirm exposure. Does your FMC have a public-facing management interface? If it’s only reachable from the internal network, the attack surface is smaller but still meaningful (VPN tunnels, branch office connections).

  2. Check the version. curl -sk https://<fmc>/api/fmc_platform/v1/info | python3 -m json.tool — the API returns the version in the response headers or the /api/fmc_config/v1/devices endpoint.

  3. Patch before the due date. CISA’s KEV due date was August 1 — we’re already past it. If you haven’t patched, you’re in the window where exploitation is most likely.

  4. Watch for the next step. If FMC is your jump box, look for devices that authenticated through FMC in the 48 hours after July 29. That’s the likely exploitation window.

The Bigger Pattern

This is the third Cisco product in KEV in two weeks. July has seen a steady drumbeat of critical enterprise products hit by unauthenticated or low-priv web vulnerabilities. The pattern:

  • FMC — unauthenticated login via low-priv account
  • ISE — session cookie replay
  • Meraki Dashboard — auth bypass on internal API

For security teams, the takeaway is simple: if your firewall management plane is internet-facing and hasn’t been patched in the last 30 days, someone is likely already reading your data.

References