Cisco has confirmed that CVE-2026-20316, a static credential flaw in Secure Firewall Management Center (FMC), was actively exploited before a patch existed.
Key facts:
The flaw comes from hardcoded credentials tied to a low-privilege account built into Cisco Secure FMC Software.
An unauthenticated remote attacker can use these credentials to log in and access data available to that account.
Cisco rated the flaw High severity despite its CVSS 3.1 base score of 5.3 because Cisco states the low-privilege access could be combined with other vulnerabilities to increase the overall impact, although it has not publicly identified those vulnerabilities.
Cisco released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.
There is no workaround that fully closes the gap.
Cisco published a specific log indicator, and the same indicator also appears in a separate, more severe FMC advisory patched the same day.
Cisco FMC CVE-2026-20316 Vulnerability: Static, hardcoded credentials for a low-privilege account in Cisco Secure FMC Software
CVSS score: 5.3 (rated High severity by Cisco due to chaining risk)
Status: Actively exploited as a zero-day; hot fixes now available
Affected: Secure FMC Software releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, regardless of device configuration
Not affected: Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, Security Cloud Control
Reported by: Jimi Sebree, Horizon3.ai
Workaround: None available; patching is required
What Happened With Cisco FMC CVE-2026-20316
Cisco Secure Firewall Management Center contains static credentials for a low-privilege account. Because these credentials are hardcoded instead of unique per deployment, anyone who knows them can use them.
As a result, an unauthenticated remote attacker can log in directly to an affected FMC system and access whatever data that low-privilege account can see. Cisco says it became aware of active exploitation in July 2026.
Cisco has not disclosed:
When the exploitation campaign began
Who is behind the attacks
Which organizations were targeted
The vulnerability affects Secure FMC Software regardless of configuration. It does not affect Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, or Security Cloud Control. Cisco credited security researcher Jimi Sebree of Horizon3.ai with reporting the issue.
Why Cisco Rated CVE-2026-20316 a High-Severity Flaw
CVE-2026-20316 has a CVSS base score of 5.3. On its own, that score typically signals a lower-priority issue.
Cisco assigned it a High severity rating because it says attackers could combine the low-privilege access this flaw grants with other vulnerabilities to increase the impact of an attack. Cisco has not identified those additional vulnerabilities or explained how attackers are chaining them.
For defenders, the CVSS number matters less than the entry point itself. FMC governs firewall policy across an organization’s network. Any unauthorized way into it deserves urgent attention, no matter how analysts score the initial access.
PAN-OS Zero-Day CVE-2026-0300 Explained
Cisco isn't the only firewall vendor dealing with a zero-day this year. See how a similar Palo Alto PAN-OS flaw played out first.
The Shared IOC Linking Two Cisco FMC Advisories
Cisco published a specific way to check for compromise tied to CVE-2026-20316.
To look for signs of exploitation:
Review the FMC log file /var/log/messages
Run cat /var/log/messages | grep license in expert mode
Look for entries referencing /var/tmp/license.tmp
A flagged example shows the FMC web process invoking Cisco’s package_info.pl script as root with that file path, which Cisco says may indicate the device was compromised.
An indicator of compromise (IOC) is a forensic artifact used to detect signs of compromise. The same IOC can appear in multiple vulnerability advisories because it may be relevant to investigations of more than one security issue, even if the vulnerabilities themselves are unrelated.
Notably, Cisco published this same /var/tmp/license.tmp indicator in its advisory for a second, Secure FMC vulnerability, CVE-2026-20079. That flaw is a critical FMC authentication bypass with a maximum CVSS score of 10.0, and Cisco updated its advisory for it on the same day.
CVE-2026-20079 differs from CVE-2026-20316 in one key way: it lets an attacker bypass authentication entirely and execute script files to obtain root access on an affected device, without relying on static credentials. Cisco has not confirmed a link between the two vulnerabilities or explained why the same indicator appears in both advisories. Cisco also says it is not currently aware of active exploitation of CVE-2026-20079.
How to Check if Attackers Exploited Your Cisco FMC
Administrators should treat this as an immediate action item, not a routine patch task. Recommended steps:
Check /var/log/messages for the /var/tmp/license.tmp indicator described above.
If the indicator is present, rotate all user credentials, keys, and certificates on the affected FMC device.
Apply Cisco’s hot fixes for the affected Secure FMC release as soon as possible, since no workaround fully resolves the issue.
Restricting the FMC management interface from public internet exposure is a general security best practice that can reduce overall attack surface, but Cisco states there is no workaround for CVE-2026-20316 and affected systems still require the appropriate hot fix.
Contact Cisco TAC for recovery assistance if you suspect compromise.
What Cisco Has Confirmed and What It Hasn’t Disclosed About CVE-2026-20316
Confirmed by Cisco:
CVE-2026-20316 was exploited as a zero-day before a fix was available.
The flaw stems from static credentials tied to a low-privilege account.
Hot fixes are available for FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.
No workaround fully addresses the issue.
Not confirmed:
The identity of the attackers
When the exploitation campaign started
Which organizations were targeted
The identity of the “other FMC vulnerabilities” Cisco says can be chained with this flaw
Any direct link between CVE-2026-20316 and CVE-2026-20079, despite the shared log indicator
Organizations should treat these as open questions. Absent the documented log indicator, there is no confirmed reason to assume the worst-case chaining scenario has already occurred in a given environment.
Featured resource
Hexnode IdP Solution Brief
Get a quick overview of how Hexnode IdP enforces MFA, RBAC, and conditional access, the same identity controls this incident makes a case for strengthening.
Where Hexnode Fits: Strengthening the Identity Layer Around Infrastructure Access
This incident is fundamentally about a static credential granting unauthorized access. That’s a useful prompt to look at how privileged access to sensitive infrastructure is handled more broadly.
Enforce MFA for administrator accounts, so a single set of credentials, static or not, is never enough on its own to reach sensitive systems.
Apply role-based access control (RBAC) to limit which admins can log in to which systems, reducing the blast radius if attackers compromise any one account.
Centralize authentication for privileged accounts under one identity layer, making it easier to see who has access to what and adjust permissions quickly when an incident like this one calls for it.
These are identity hygiene practices worth strengthening regardless of this specific CVE, and Hexnode IdP’s MFA and RBAC capabilities support exactly that layer of defense. Applying Cisco’s hot fixes remains the direct fix for CVE-2026-20316 itself.
FAQs
Does patching CVE-2026-20079 matter if Cisco hasn’t confirmed it’s being exploited?
Yes. Even though Cisco reports no active exploitation, CVE-2026-20079 is critical (CVSS 10.0), allows unauthenticated root access, and has no workaround. Cisco has released hot fixes, so administrators should patch immediately.
Does restricting FMC’s management interface from the internet fully protect against CVE-2026-20316?
No. Limiting internet exposure only reduces the attack surface; it doesn’t fix the underlying static credential issue. Cisco states that no workaround fully addresses the vulnerability, so administrators still need the hot fix even when they haven’t exposed the management interface to the public internet.
Why This Incident Is Worth Tracking
FMC sits above the firewalls it manages. That is why Cisco treated a 5.3-severity credential issue as a High priority rather than a routine fix.
Two things make this worth watching closely:
Cisco updated two separate FMC advisories on the same day, and confirmed exploitation for one of them.
Both advisories share the same log indicator, without a confirmed link between them.
Until Cisco discloses more about the chaining vulnerabilities or the scope of exploitation, treating any FMC deployment as needing immediate patching, not a routine update cycle, is the more defensible posture.
Reduce Reliance on Static Credentials for Privileged Access
See how Hexnode IdP enforces MFA, RBAC, and device-aware conditional access for the admin accounts that manage your critical infrastructure.
I write at the intersection of technology, process, and people, focusing on explaining complex products with clarity. I break down tools, systems, and workflows without any noise, jargon, or the hype.
