Cisco has disclosed that a high-severity static credential vulnerability in Secure Firewall Management Center (FMC) software is being actively exploited in zero-day attacks. Tracked as CVE-2026-20316, this flaw allows unauthenticated remote attackers to leverage hardcoded credentials to gain unauthorized access to sensitive data. A companion critical authentication bypass vulnerability, CVE-2026-20079 (CVSS 10.0), was also updated with new indicators of compromise and hot fixes. Both vulnerabilities affect on-premises Cisco Secure FMC deployments and require immediate patching.

Vulnerability Details

CVE-2026-20316: Static Credential Flaw (CVSS 5.3, High Severity)

The primary vulnerability stems from static credentials embedded in a low-privilege account within Cisco Secure FMC Software. An unauthenticated remote attacker with network access to the FMC management interface can use these credentials to log in and access sensitive data available to that account.

While the base CVSS score is 5.3 (Medium), Cisco assigned a High severity rating because the access obtained can be combined with other FMC vulnerabilities to elevate privileges. The vendor has not publicly identified the additional vulnerabilities or explained how they are being chained in attacks.

Affected Products:

• Cisco Secure FMC Software releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0

Not Affected:

• Cloud-Delivered FMC
• Firewall Device Manager
• Secure Firewall ASA Software
• Secure Firewall Threat Defense Software
• Security Cloud Control

CVE-2026-20079: Authentication Bypass (CVSS 10.0, Critical)

Updated concurrently, this critical authentication bypass allows an unauthenticated remote attacker to bypass authentication entirely and execute scripts and commands as root by sending specially crafted HTTP requests to an affected FMC device. Unlike CVE-2026-20316, this flaw does not require credentials or prior access.

Cisco originally disclosed CVE-2026-20079 in March 2026 and updated the advisory on July 29, 2026, to add a second bug ID, hot fixes, and indicators of compromise. Cisco states it is not aware of malicious exploitation of CVE-2026-20079, but the shared indicator of compromise with CVE-2026-20316 raises questions about potential connections.

Active Exploitation and Attribution

Cisco became aware of active exploitation of CVE-2026-20316 in July 2026. The company has not disclosed:

• When the attacks began
• Which threat actors are responsible
• Which organizations were targeted

The vulnerability was reported by Jimi Sebree of Horizon3.ai. Horizon3.ai has a track record of discovering and responsibly disclosing critical infrastructure vulnerabilities.

Indicators of Compromise

Cisco published the same indicator of compromise for both vulnerabilities. Administrators should review the /var/log/messages log file on affected FMC devices for signs of compromise.

Run the following command in expert mode:

A log entry containing /var/tmp/license.tmp may indicate compromise. Example suspicious entry:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

This entry shows the FMC web process (running under the www account) invoking Cisco's package_info.pl script as root with the /var/tmp/license.tmp file.

If this indicator is found, Cisco advises:

1. Assume the device is compromised
2. Rotate all user credentials, keys, and certificates on the affected FMC device
3. Contact Cisco TAC for assistance with recovery

Mitigation and Patching

Hot Fixes Released

Cisco has released hot fixes for both vulnerabilities for all affected Secure FMC releases:

FMC Release	Hot Fix
7.0	Available
7.2	Available
7.4	Available
7.6	Available
7.7	Available
10.0	Available

Hot fixes can be downloaded from the Cisco Software Center. There are no workarounds that fully address either vulnerability.

Defense-in-Depth Recommendations

While patching is the only complete remediation, Cisco notes that the attack surface is reduced when the FMC management interface is not exposed to the public internet. Organizations should:

1. Restrict management interface access to trusted networks only
2. Implement network segmentation between management and data planes
3. Enable logging and monitoring for all FMC management access
4. Audit user accounts and credentials regularly
5. Apply the principle of least privilege to FMC administrative accounts

Impact Assessment

For Security Teams

A compromised FMC device provides attackers with:

• Visibility into firewall policies and network topology
• Access to VPN configurations and certificates
• Potential lateral movement to managed firewalls
• Ability to modify security policies to allow malicious traffic
• Access to threat intelligence feeds and configuration backups

The static credential flaw is particularly concerning because it may have existed in the codebase for multiple releases, giving attackers a persistent backdoor.

For Compliance and Audit

Organizations subject to regulatory requirements (PCI DSS, HIPAA, SOX, etc.) should:

• Document the exposure window
• Assess whether sensitive data accessible via FMC was accessed
• Update incident response plans to include FMC compromise scenarios
• Report to relevant authorities if data exposure is confirmed

Frequently Asked Questions

Does CVE-2026-20316 affect Cisco Firepower Management Center?

Yes. Cisco Secure FMC is the rebranded name for Firepower Management Center. The vulnerability affects Secure FMC Software (formerly Firepower Management Center) on-premises deployments.

Are Cisco Secure Firewall appliances affected?

No. The vulnerability is in the management center software (FMC), not the firewall appliances themselves (Threat Defense, ASA). However, a compromised FMC can be used to manipulate managed firewalls.

Is there a workaround if I cannot patch immediately?

No complete workaround exists. The only mitigation is to restrict network access to the FMC management interface to trusted IP ranges. This reduces the attack surface but does not eliminate the vulnerability.

How do I know if I am running an affected version?

Log into your FMC web interface and navigate to System > Updates to see your current version. Compare against the affected releases listed above.

What is the difference between the two CVEs?

Aspect	CVE-2026-20316	CVE-2026-20079
CVSS Score	5.3	10.0
Severity	High (Cisco rating)	Critical
Access Required	Network access to FMC	Network access to FMC
Credentials Needed	Static credentials (embedded)	None (auth bypass)
Privilege Escalation	Requires chaining	Direct root access
Active Exploitation	Yes (zero-day)	Not confirmed
Disclosure Date	July 29, 2026	March 2026 (updated July 29)

Should I prioritize one CVE over the other?

Patch both immediately. CVE-2026-20316 is actively exploited. CVE-2026-20079 provides a direct path to root and shares an indicator of compromise with the exploited flaw, suggesting they may be related in attack chains.

Key Takeaways

1. Two critical FMC vulnerabilities disclosed July 29, 2026
2. CVE-2026-20316 is actively exploited in zero-day attacks — static credentials in low-privilege account
3. CVE-2026-20079 is a CVSS 10.0 authentication bypass updated with new IOCs and hot fixes
4. All on-premises FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, 10.0 affected
5. No workarounds — hot fixes are the only complete remediation
6. Shared IOC (/var/tmp/license.tmp in /var/log/messages) for both vulnerabilities
7. Compromise response: rotate all credentials, keys, certificates; contact Cisco TAC
8. Cloud-delivered FMC and Security Cloud Control are not affected

Conclusion

The active exploitation of CVE-2026-20316 as a zero-day, combined with the critical authentication bypass in CVE-2026-20079, creates an urgent risk for every organization running on-premises Cisco Secure FMC. The management center is a high-value target: compromise it, and you gain control over the entire firewall estate. Security teams should apply hot fixes immediately, hunt for the published indicators of compromise, and assume that any unpatched FMC exposed to untrusted networks may already be compromised. The lack of workarounds and the shared indicator of compromise between the two vulnerabilities suggest sophisticated attack chains may already be in use.

---

Sources: Cisco Security Advisory: CVE-2026-20316, Cisco Security Advisory: CVE-2026-20079, BleepingComputer: Cisco warns of FMC static credential flaw exploited in zero-day attacks, Horizon3.ai Research