Cisco FMC Zero-Day CVE-2026-20316: Actively Exploited Static Credentials Flaw

Cisco Secure Firewall Management Center (FMC) software contains a critical zero-day vulnerability tracked as CVE-2026-20316 that is being actively exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 29, 2026, mandating federal agencies to patch by August 1, 2026. The vulnerability allows unauthenticated remote attackers to log in using static low-privilege credentials and access sensitive data.

Vulnerability Details

CVE ID: CVE-2026-20316 CVSS Score: 5.3 (Medium) - rated High SIR by Cisco due to chaining potential Affected Product: Cisco Secure Firewall Management Center (FMC) Software Attack Vector: Network, unauthenticated, low-privilege account login Impact: Sensitive data exposure, potential privilege escalation via chaining Exploitation Status: Actively exploited in the wild since early July 2026 CISA KEV Added: July 29, 2026 Federal Deadline: August 1, 2026 (FCEB agencies)

Root Cause Analysis

The vulnerability exists due to static user credentials for a low-privileged account present in the FMC software. Cisco's advisory states: "This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system."

While the CVSS base score is 5.3 (Medium), Cisco assigns a Security Impact Rating (SIR) of High because this flaw can be chained with CVE-2026-20079 (CVSS 10.0), a critical authentication bypass vulnerability in the same product. CVE-2026-20079 enables arbitrary script execution for root access, and both vulnerabilities share the same indicator of compromise (/var/tmp/license.tmp), indicating threat actors could chain them for full code execution.

Security researcher Jimi Sebree of Horizon3.ai discovered and reported the flaw. Cisco confirmed active exploitation began earlier in July 2026 but did not disclose the threat actor identity or specific exploitation methods.

Affected Versions & Hotfixes

FMC Version	Hotfix Filename
7.0	Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2	Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4	Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6	Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7	Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0	Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

All affected versions require the corresponding hotfix. There are no workarounds that fully mitigate the vulnerability.

Impact Assessment

Direct Impact: Unauthenticated attackers can log in as a low-privileged user and access sensitive data including:

• Network topology and configuration details
• Firewall rules and policies
• VPN credentials and certificates
• Logging and monitoring data
• User account information

Chained Impact (Critical): When combined with CVE-2026-20079 (authentication bypass, CVSS 10.0), attackers can escalate from low-privilege access to root-level code execution on the FMC appliance. The shared /var/tmp/license.tmp IoC strongly suggests this chaining is feasible and likely being exploited.

Risk Context: FMC appliances centrally manage Cisco Secure Firewall deployments. Compromise of the management center provides attackers with visibility into and control over the entire firewall estate, making this a high-value target for network infiltration and persistence.

Mitigation & Patching

Immediate Hotfix Application (Required)

Download and apply the appropriate hotfix for your FMC version from Cisco's Software Center. The hotfixes are .sh.REL.tar files that must be installed via the FMC CLI in expert mode.

Network Segmentation (Defense-in-Depth)

Cisco notes the attack surface is reduced if the FMC management interface does not have public internet access. Ensure:

• FMC management interfaces are on dedicated, isolated management networks
• No direct internet exposure for FMC web interfaces
• Jump hosts or VPNs required for administrative access

Detection: Indicators of Compromise

Cisco urges customers to check for exploitation using this CLI command in expert mode:

If the output includes /var/tmp/license.tmp, there is a possibility the vulnerability has been exploited:

This same IoC applies to CVE-2026-20079, so its presence indicates potential exploitation of either or both vulnerabilities.

CVE-2026-20079 Advisory Update

Cisco has updated the advisory for CVE-2026-20079 (critical auth bypass, CVSS 10.0) to include:

• Second bug ID: CSCwt95974
• Same /var/tmp/license.tmp IoC
• Hotfixes for affected versions

While Cisco states it is not aware of malicious exploitation of CVE-2026-20079, the shared IoC with the actively exploited CVE-2026-20316 makes this assumption tenuous. Organizations should treat both as actively exploited.

Frequently Asked Questions

Is there a workaround without applying the hotfix?

No. The static credentials exist in the software binary. Network segmentation reduces exposure but does not eliminate the vulnerability. Hotfix installation is the only complete fix.

Does this affect Firepower Threat Defense (FTD) managed devices?

No. This vulnerability affects the Firewall Management Center (FMC) management appliance only. FTD sensors managed by FMC are not directly vulnerable, but a compromised FMC can push malicious policies to managed devices.

What is the difference between CVSS 5.3 and Cisco's High SIR?

CVSS 5.3 reflects the base vulnerability (low-privilege data access). Cisco's High SIR accounts for the chaining potential with CVE-2026-20079 (CVSS 10.0) which enables root code execution. The shared IoC confirms this chaining is a realistic attack path.

How do I know if my FMC was already compromised?

Run the license.log check above. Also review FMC audit logs for:

• Unexpected logins from unknown IP addresses
• Low-privilege account usage at unusual times
• Configuration changes not authorized by your team
• The package_info.pl command with /var/tmp/license.tmp in logs

What should federal agencies do?

FCEB agencies must apply hotfixes by August 1, 2026 per CISA Binding Operational Directive. Non-federal organizations should patch immediately given active exploitation.

Key Takeaways

• CVE-2026-20316 is an actively exploited zero-day in Cisco FMC with static credentials
• CVSS 5.3 but High SIR due to chaining with CVE-2026-20079 (CVSS 10.0) for root RCE
• CISA KEV listing mandates federal patching by August 1, 2026
• IoC: /var/tmp/license.tmp in /var/log/messages indicates potential exploitation
• No workarounds - hotfix installation is required for all affected versions (7.0, 7.2, 7.4, 7.6, 7.7, 10.0)
• Isolate FMC management interfaces from the internet as defense-in-depth

Conclusion

CVE-2026-20316 demonstrates how seemingly medium severity vulnerabilities become critical when chaining potential exists. The active exploitation and CISA KEV listing make this an urgent patch for any organization running Cisco Secure FMC. Apply the hotfix immediately, verify no compromise via the license.log IoC, and ensure FMC management interfaces are not internet-accessible.

---

Sources: The Hacker News, Cisco Security Advisory, CISA KEV Catalog, Help Net Security, The Cyber Express