Cisco FMC Zero-Day CVE-2026-20316: Static Credential Flaw Actively Exploited in the Wild

CISA has added a critical Cisco Secure Firewall Management Center (FMC) vulnerability to its Known Exploited Vulnerabilities catalog after confirming active zero-day exploitation. The flaw, tracked as CVE-2026-20316, allows unauthenticated attackers to leverage hardcoded static credentials to access sensitive data on affected FMC appliances , and it can be chained with a separate CVSS 10.0 authentication bypass for full root compromise.

Vulnerability Details

CVE-2026-20316 (CVSS 5.3, Cisco SIR: High) stems from static user credentials embedded in Cisco Secure FMC Software for a low-privileged account. An unauthenticated, remote attacker can use these credentials to log in to an affected system and access sensitive data available to that account.

Cisco assigned a High Security Impact Rating (SIR) rather than Medium because the vulnerability can be chained with CVE-2026-20079 (CVSS 10.0), a critical authentication bypass flaw that enables unauthenticated remote code execution as root. Both flaws share the same indicator of compromise: /var/tmp/license.tmp appearing in /var/log/messages.

Attribute	Details
CVE ID	CVE-2026-20316
CVSS v3.1 Score	5.3 (Medium)
Cisco SIR	High
Attack Vector	Network (remote)
Authentication	None required
User Interaction	None required
Impact	Confidentiality (Low), Integrity (None), Availability (None)
Discovered by	Jimi Sebree, Horizon3.ai
CISA KEV Added	July 29, 2026
CISA Emergency Order	FCEB agencies must patch by August 1, 2026

Impact Assessment

The vulnerability affects Cisco Secure FMC Software across multiple major versions. While the base CVSS score is 5.3, the real-world risk is significantly higher because:

1. Active exploitation confirmed , Cisco acknowledged the flaw was being exploited in July 2026 before the advisory was published.
2. Credential reuse , The static credentials are the same across all affected installations.
3. Privilege escalation chain , When combined with CVE-2026-20079 (CVSS 10.0), attackers can achieve unauthenticated root RCE.
4. No workarounds , Cisco states there are no configuration changes that fully mitigate the vulnerability; patching is mandatory.

The attack surface is reduced if the FMC management interface is not exposed to the public internet, but internal network compromise or VPN access still enables exploitation.

Affected Systems

The following Cisco Secure FMC Software versions are vulnerable and require hotfix installation:

Version	Hotfix Filename
7.0	Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2	Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4	Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6	Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7	Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0	Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Not affected: Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, and Security Cloud Control.

Mitigation & Patching

Immediate action required:

1. Identify affected appliances , Inventory all Cisco Secure FMC deployments in your environment.
2. Apply hotfixes immediately , Download the appropriate hotfix for your version from Cisco Software Central and install per the release notes.
3. Verify installation , Confirm the hotfix version is reported in the FMC web interface.
4. Rotate credentials , If compromise is suspected, rotate all user credentials, API keys, and certificates on the affected FMC device.
5. Contact Cisco TAC , For assistance with recovery if indicators of compromise are found.

CISA Emergency Order: Federal Civilian Executive Branch (FCEB) agencies were directed to apply fixes by August 1, 2026. This underscores the urgency , this is not a routine patch cycle.

Detection

Cisco has published a specific indicator of compromise for both CVE-2026-20316 and CVE-2026-20079. Administrators should run the following command in expert mode on each FMC appliance:

If the output includes /var/tmp/license.tmp, the appliance may have been compromised:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

This log entry shows the FMC web process (www user) invoking Cisco's package_info.pl script as root with the suspicious /var/tmp/license.tmp file , a clear sign of exploitation activity.

Suricata Detection Rule

YARA Rule

Sigma Rule

Frequently Asked Questions

Is CVE-2026-20316 exploitable without authentication?

Yes. The vulnerability allows unauthenticated remote attackers to log in using static credentials that are the same across all affected FMC installations.

What is the difference between CVE-2026-20316 and CVE-2026-20079?

CVE-2026-20316 (CVSS 5.3): Static credential flaw allowing low-privilege access. CVE-2026-20079 (CVSS 10.0): Authentication bypass enabling unauthenticated root RCE. They share the same IoC (/var/tmp/license.tmp) and can be chained for full compromise.

Are there any workarounds?

No. Cisco explicitly states there are no workarounds that fully address either vulnerability. The only mitigation is applying the hotfixes.

Does this affect Cisco ASA or Firepower Threat Defense?

No. The vulnerability only affects Cisco Secure FMC Software (management center). ASA Software, Threat Defense, Firewall Device Manager, Cloud-Delivered FMC, and Security Cloud Control are not affected.

How do I know if I've been compromised?

Run cat /var/log/messages | grep license in expert mode. If /var/tmp/license.tmp appears, investigate immediately and contact Cisco TAC.

What is the CISA emergency order deadline?

Federal Civilian Executive Branch agencies must apply fixes by August 1, 2026. Private sector organizations should treat this with equivalent urgency.

Key Takeaways

• CVE-2026-20316 is an actively exploited zero-day in Cisco Secure FMC with static credentials , patch immediately.
• The flaw is chainable with CVE-2026-20079 (CVSS 10.0) for unauthenticated root RCE, making the effective severity critical.
• CISA added it to KEV on July 29, 2026 and ordered FCEB agencies to patch by August 1, 2026.
• No workarounds exist , hotfixes are mandatory for all affected versions (7.0, 7.2, 7.4, 7.6, 7.7, 10.0).
• Detection is straightforward: check /var/log/messages for /var/tmp/license.tmp.
• Rotate all credentials on any appliance showing signs of compromise.

---

Sources: Cisco Security Advisory, CISA KEV Alert, The Hacker News, BleepingComputer, Cisco Advisory for CVE-2026-20079