Cisco FMC Zero-Day (CVE-2026-20316): Static Credentials Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency added a critical Cisco Secure Firewall Management Center flaw to its Known Exploited Vulnerabilities catalog on July 29, 2026, after confirming active zero-day exploitation today. Tracked as CVE-2026-20316 with a CVSS 5.3 score, this vulnerability allows unauthenticated remote attackers to access sensitive data through hardcoded static credentials.

Vulnerability Details

CVE-2026-20316 stems from the presence of static user credentials for a low-privileged account in Cisco Secure Firewall Management Center (FMC) Software. An attacker can exploit this by simply logging in with the hardcoded account credentials to access sensitive data as that user.

Cisco assigned this vulnerability a Security Impact Rating (SIR) of High rather than Medium because it can be chained with other Cisco Secure FMC vulnerabilities to elevate privileges : particularly CVE-2026-20079 (CVSS 10.0), a critical authentication bypass that enables arbitrary script execution for root access.

Affected versions and hotfixes:

Version	Hotfix File
7.0	Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2	Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4	Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6	Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7	Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0	Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Security researcher Jimi Sebree of Horizon3.ai discovered and reported the flaw. Cisco acknowledged active exploitation began earlier in July 2026 but did not disclose the threat actor identity or specific exploitation methods.

Impact Assessment

While the base CVSS score is 5.3 (Medium), the real-world impact is significantly higher due to:

1. Credential exposure: The static credentials provide a foothold for unauthenticated access
2. Chaining potential: Combined with CVE-2026-20079 (auth bypass to root RCE), attackers can achieve full system compromise
3. Network pivot: FMC manages firewall policies: compromise enables lateral movement across the security infrastructure
4. CISA KEV listing: Mandatory patch deadline of August 1, 2026 for Federal Civilian Executive Branch agencies

Indicators of compromise include the presence of /var/tmp/license.tmp in system logs. Cisco recommends running this CLI command in expert mode to check for exploitation:

Expected malicious output:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

Affected Systems

Organizations running Cisco Secure Firewall Management Center Software versions 7.0, 7.2, 7.4, 7.6, 7.7, or 10.0 are vulnerable. The attack surface is reduced if the FMC management interface is not exposed to the public internet: a critical network segmentation practice.

Mitigation and Patching

Immediate actions:

1. Apply the appropriate hotfix for your FMC version immediately
2. Restrict FMC management interface access to trusted internal networks only
3. Run the IoC detection command on all FMC devices
4. Rotate any credentials that may have been accessed

CISA-mandated deadline: Federal agencies must apply fixes by August 1, 2026. Private sector organizations should treat this with equal urgency given confirmed active exploitation.

Detection

Monitor for:

• Unexpected logins from the low-privileged static account
• /var/tmp/license.tmp appearing in system logs
• Unusual sudo commands invoking package_info.pl
• Chained exploitation attempts against CVE-2026-20079

Frequently Asked Questions

Q: Why is a CVSS 5.3 vulnerability in the CISA KEV catalog? A: CISA considers active exploitation and chaining potential. The ability to combine this with CVE-2026-20079 (CVSS 10.0) for full RCE elevates the practical risk far above the base score.

Q: Does this affect Cisco Firepower devices directly? A: No: this affects the Firewall Management Center (FMC) that manages Firepower devices. However, compromising FMC gives control over all managed firewalls.

Q: Are there workarounds if I cannot patch immediately? A: Restrict FMC management interface to trusted internal IPs only. Block all external access. This significantly reduces the attack surface but is not a substitute for patching.

Q: Has a threat actor been attributed? A: Cisco has not disclosed the threat actor identity or specific campaign details.

Key Takeaways

• CVE-2026-20316 is actively exploited in the wild: patch immediately
• The static credentials flaw enables chaining with CVE-2026-20079 for root RCE
• CISA mandates federal agency patching by August 1, 2026
• Network segmentation (no public FMC access) is a critical compensating control
• Check for /var/tmp/license.tmp in logs as an IoC

---

Sources: Cisco Security Advisory, CISA KEV Alert, The Hacker News, BleepingComputer