Cisco Secure Firewall Management Center: Zero Day Actively Exploited

Affected Environment
Cisco Secure Firewall Management Center software, all releases, regardless of device configuration; cdFMC, FDM, ASA, FTD, SCC unaffected.

Threat Overview
Static low privileged credentials in the FMC web interface allow unauthenticated remote login; active exploitation is already confirmed.

Exposure Timeline
Disclosed 29 July 2026 with active exploitation already ongoing at disclosure; no advance warning window before the public advisory.

Attack Surface
FMC web management interface; risk is reduced only when the management interface has no public internet access.

Technical Root Cause
Hardcoded static credentials tied to a low privileged account exist in FMC software, bypassing intended authentication controls.

Exploitation Pathway
Attacker logs in remotely using static credentials, accesses sensitive data, and can chain with other flaws to escalate privileges.