CVE-2026-20316 static credential login to Cisco FMC
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Microsoft Sentinel (KQL)
