Cisco Secure Firewall Management Center Static Credential Vulnerability Exploited as a Zero-Day (CVE-2026-20316)

Published: Thu 30 July 2026

Prepared by: Adam Skupien, Vulnerability Security Analyst

Purpose

Cisco has disclosed CVE-2026-20316, a static/hard-coded credential vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software and confirmed it was actively exploited as a zero-day prior to disclosure. An unauthenticated attacker who reaches the FMC web interface can use the built-in static credentials to log in as a low-privileged account and access sensitive data. Cisco has rated the issue High severity - a step above what the CVSS score alone would suggest - because the access this vulnerability grants can be chained with other (currently undisclosed) FMC vulnerabilities to escalate to full compromise. Cisco has released hot fixes for all supported FMC branches. There are no workarounds. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. 

Vulnerability details

• Severity: High (Cisco Security Impact Rating, or SIR - Cisco's own severity rating, which sits alongside CVSS and reflects the vendor's assessment of real-world risk). CVSS v3.1 Base Score: 5.3  which would normally map to a Medium SIR. Cisco has deliberately overridden that default and assigned High instead, because this access can be combined with other FMC vulnerabilities to elevate privileges.
• Exploit status: Exploited in the wild as a zero-day (vendor-confirmed). Cisco PSIRT became aware of active exploitation in July 2026.
• Patch status: Fixed. Cisco has released hot fixes for all affected FMC release branches. No workarounds are available - patching is the only remediation.
• Vulnerability type: Use of hard-coded/static credentials (CWE-259) for a built-in, low-privileged account.
• Impact: Unauthenticated remote login to the FMC web interface as the low-privileged account, granting access to sensitive data. Cisco warns this access may be usable as a stepping stone toward privilege escalation via other, currently unidentified FMC vulnerabilities.
• Exploitation requirements/characteristics:
  • No authentication required (the credentials are baked into the product).
  • No user interaction required.
  • Requires network access to the FMC web management interface.
• Exposure condition: This vulnerability affects all Cisco Secure FMC deployments, regardless of configuration - the static credentials are built into the software itself, not introduced by a specific setup. Internet exposure is not a precondition for the vulnerability to be present; it is a precondition for remote, unauthenticated exploitation. Any network path to the FMC management interface - direct internet exposure, a compromised internal host, VPN access, or lateral movement from elsewhere in the environment - is sufficient to reach and use the credentials. Risk is highest where the management interface is internet-facing, but instances restricted to internal networks are not immune, only harder to reach.

Affected Systems:

Cisco Secure Firewall Management Center (FMC) Software - all supported on-premises releases.

Not affected:

• Cloud-Delivered FMC (cdFMC)
• Firewall Device Manager (FDM)
• Secure Firewall Adaptive Security Appliance (ASA) Software
• Secure Firewall Threat Defense (FTD) Software
• Security Cloud Control (SCC), formerly Defense Orchestrator

Related vulnerability - remediated by the same hot fixes: On the same day, Cisco updated its advisory for CVE-2026-20079, a Critical (CVSS 10.0) FMC authentication bypass vulnerability that allows unauthenticated attackers to execute commands as root without needing any credentials at all. Cisco has confirmed that the hot fixes listed in the table above (for CVE-2026-20316) also remediate CVE-2026-20079 - these are not separate patches, and no additional action is required beyond applying the hot fix for your FMC branch. Both advisories also share the same forensic indicator (see Detection capabilities). Cisco has not confirmed active exploitation of CVE-2026-20079 at the time of writing.

Impact

Successful exploitation grants an unauthenticated attacker a foothold on the FMC management plane - the system that manages policy and configuration across an organisation's Cisco firewall estate. On its own, this discloses sensitive data accessible to the low-privileged account; Cisco's own advisory indicates this access may enable further compromise when combined with other undisclosed FMC flaws. Risk is highest where the FMC web management interface is exposed to the internet or reachable from untrusted network segments. 

Mitigation actions

Immediate actions:

• Apply the appropriate Cisco hot fix for your FMC release branch immediately — there are no workarounds. Hot fixes are available via the Cisco Software Center.
• Confirm the FMC management interface is not reachable from the internet or untrusted networks; restrict access to trusted management segments only.
• Given confirmed active exploitation prior to patch availability, rotate all user credentials, keys, and certificates on affected FMC devices after patching, as recommended by Cisco.
• Use the Cisco Software Checker tool to confirm your specific release and identify the correct fixed/hot fix version.

Patching:

• Cisco has released hot fixes for FMC releases 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 (see table above). Apply the fix matching your deployed release.

Detection capabilities

Inventory all Cisco Secure FMC instances and confirm exposure of the management web interface to untrusted networks. Check for the following indicator of compromise on each FMC device, in expert mode:

cat /var/log/messages | grep license

If the output contains a reference to /var/tmp/license.tmp it may indicate the device has been exploited. If this indicator is present, rotate all credentials, keys, and certificates on the device and engage Cisco TAC for recovery assistance.

Ensure FMC logs are forwarded to, ingested by, and actively monitored within a SIEM. Escalate any suspicious findings via standard incident response channels and preserve logs for investigation.

MDR customers: Triskele Labs will continue tuning detections for behaviours consistent with exploitation of CVE-2026-20316 (and CVE-2026-20079) across supported log sources.

Vulnerability Management customers: Environments will be assessed for vulnerable Cisco FMC versions and internet exposure; findings will be communicated through priority channels.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
• https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-onprem-fmc-authbypass-5JPp45V2.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2026-20316
• https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/