• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    LOCAL EXPLOIT Cisco FMC static service account name in login POST (CVE-2026-20316)

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ali AlEnezi@site
    •updated Sep 14, 2026•0•0•2

    Detects HTTP POST requests targeting Cisco Firepower Management Center (FMC) that contain strings associated with internal service account processes or configuration files, indicative of an attempt to exploit CVE-2026-20316.

    Suricata

    Tags

    T1190 - Exploit Public-Facing ApplicationHTTP RequestExploit AttemptIDS IPS AlertNetwork GenericSnort IDSCVE-2026-20316HTTPAttempted Admin

    Found in

    • Cisco SD-WAN and Firewall Campaign UAT-8616Last updated 28 days ago
    • Exploitation of Cisco Secure FMC VulnerabilitiesLast updated Sep 10, 2026
    • Exploitation of Cisco Secure FMC VulnerabilitiesLast updated Sep 10, 2026
    • Exploitation of Cisco Secure FMC VulnerabilitiesLast updated Sep 10, 2026
    • Exploitation of Cisco Secure FMC VulnerabilitiesLast updated Sep 10, 2026
    • Exploitation of Cisco Secure FMC VulnerabilitiesLast updated Sep 10, 2026
    • PEEP Post-Exploitation Browser RAT SummaryLast updated Sep 8, 2026
    • PEEP Post-Exploitation Browser RAT SummaryLast updated Sep 8, 2026
    • PEEP Post-Exploitation Browser RAT SummaryLast updated Sep 8, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?