CVE-2026-20316: static Cisco FMC account exploited

On 30 July 2026, wider reporting described CVE-2026-20316, an actively exploited Cisco Secure Firewall Management Center vulnerability. Static credentials for a low-privileged account allow an unauthenticated remote attacker to log in to affected FMC and access sensitive information available to that role.

Its base CVSS score is 5.3, which can look moderate. Cisco assigned a High Security Impact Rating because the access can be combined with other FMC vulnerabilities for privilege escalation. The vendor confirmed July exploitation and provides no workaround.

Essential facts from Cisco

Cisco’s official advisory, published on 29 July, confirms:

• CVE-2026-20316;
• CWE-259, use of hard-coded credentials;
• CVSS 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N;
• remote attack without prior authentication;
• login as a low-privileged account;
• access to sensitive information;
• affected Cisco Secure FMC regardless of configuration;
• no workaround that removes the vulnerability;
• available hotfixes;
• active exploitation in July 2026;
• credential, key and certificate rotation when exploitation is suspected.

CISA added the vulnerability to Known Exploited Vulnerabilities and gave US federal agencies a 1 August 2026 remediation deadline. That date is not automatically a legal deadline for a private Polish company, but it demonstrates operational urgency.

What a static account means

Static credentials are embedded across product installations instead of being uniquely generated for each organisation. Once an attacker learns them, the problem is not one customer’s stolen password. The same material may work against many affected systems.

The account is low-privileged, so this CVE alone does not promise immediate root. It can still provide:

• entry without a legitimate identity;
• data visible to the role;
• version, configuration and environment reconnaissance;
• preparation for further escalation;
• use of FMC’s trusted position in the management network.

On a firewall manager, even read-oriented access may reveal topology, policy, network objects, integrations and information useful for a second stage. Exact data depends on the product and role; Cisco has not published a complete inventory of information obtained in observed attacks.

Why 5.3 is not a low-priority queue

CVSS describes one vulnerability, not its deployment context:

• management may be internet-accessible;
• the system controls critical firewalls;
• exploitation is confirmed;
• other FMC flaws permit escalation;
• static credentials enable broad automated scanning;
• FMC may hold valuable keys and certificates.

Cisco deliberately raised its Security Impact Rating above what the base score suggests. This is why vulnerability management must combine CVSS, KEV, exposure, asset value and chaining potential.

Possible interaction with CVE-2026-20079

Cisco also updated CVE-2026-20079, a critical FMC authentication bypass scored 10.0. It can lead to arbitrary script execution and root access. The vendor added a second bug ID and the same /var/tmp/license.tmp indicator.

That overlap suggests possible chaining but requires precision:

• Cisco confirms exploitation of CVE-2026-20316;
• Cisco does not publicly confirm malicious exploitation of CVE-2026-20079;
• a shared indicator does not prove both vulnerabilities were used in every incident;
• one product path can appear in several technical sequences.

Review both advisories and use Cisco Software Checker’s Combined First Fixed result rather than assuming one hotfix closes every path.

Product scope

CVE-2026-20316 affects Cisco Secure Firewall Management Center Software. Cisco says the vulnerability exists regardless of device configuration. Removing internet access reduces the reachable surface but does not make the installed version fixed.

Cisco confirmed that this CVE does not affect:

• Cloud-Delivered FMC;
• Firewall Device Manager;
• Secure Firewall ASA Software;
• Secure Firewall Threat Defense Software;
• Security Cloud Control, formerly Defense Orchestrator.

“Not affected” applies to this CVE, not every advisory for those products.

Available hotfixes

Cisco published:

• 7.0 — Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar;
• 7.2 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar;
• 7.4 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar;
• 7.6 — Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar;
• 7.7 — Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar;
• 10.0 — Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar.

These names were current at publication. Always confirm the live advisory and Software Checker output. An article copy does not replace the vendor matrix.

There is no workaround. Restricting management access mitigates exposure but does not remove hard-coded credentials.

Cisco’s exploitation indicator

Cisco recommends checking /var/log/messages in expert mode for entries containing license. Its suspicious example executes:

/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

The presence of /var/tmp/license.tmp means exploitation may have occurred. It does not independently prove full compromise or actor attribution. Its absence does not guarantee safety where logs were deleted, rotated or not retained for the full exposure period.

Preserve before making changes:

• current and rotated /var/log/messages;
• system time and time zone;
• administrative sessions;
• configuration-change history;
• new and changed accounts;
• API activity;
• configuration exports;
• network access to the management interface;
• bastion, VPN and identity logs.

Cisco recommends contacting TAC when the indicator is present or exploitation is suspected.

Why public management access is dangerous

Cisco notes that removing internet access reduces the surface. FMC should be reachable only from a dedicated management network through a bastion or privileged workstation with strong authentication.

“Corporate network only” is insufficient when:

• VPN gives every user broad access;
• office segments can directly reach FMC;
• supplier endpoints retain permanent routes;
• management shares identities with daily work;
• monitoring ignores low-privileged account logins;
• backup FMC systems sit in a weaker segment.

Segmentation limits who can use the static account. It does not fix it, so the hotfix remains mandatory.

Remediation plan

1. inventory all FMC systems, including standby, lab and powered-off appliances;
2. determine the release and hotfix through Cisco Software Checker;
3. restrict the interface to necessary sources;
4. preserve logs before updating;
5. search the official indicator and wider anomalies;
6. install the correct line’s hotfix;
7. verify build and health after restart;
8. review both advisories, including CVE-2026-20079;
9. contact TAC when exploitation is suspected;
10. rotate accounts, keys and certificates in scope.

Updating does not reverse access obtained earlier. Separate remediation from incident response.

Credential, key and certificate rotation

Cisco’s minimum recommendation for suspected exploitation covers all credentials, keys and certificates on FMC. Scope can include:

• local administrators;
• service accounts;
• LDAP/RADIUS/TACACS+ integrations;
• API tokens;
• device certificates;
• managed-firewall connections;
• backup and automation secrets.

Rotate after active access is contained and the device is fixed; otherwise an attacker may collect replacement values. Plan dependencies carefully to preserve firewall management.

Our secrets-management and rotation guide explains the broader process.

Detection and monitoring

Beyond Cisco’s indicator, alert on:

• login by an identity absent from corporate IAM;
• first use of an unusual low-privileged role;
• FMC access outside the bastion;
• bulk configuration reads;
• creation or execution from /var/tmp;
• the www identity invoking a root command;
• policy, object, integration or certificate changes;
• configuration export outside maintenance;
• outbound FMC connections to new destinations.

Correlate login, temporary-file creation, package_info.pl execution and configuration change. Our Sigma and SIEM detection-engineering guide provides the methodology.

Closure evidence

Close the issue only when evidence shows:

• every appliance has the hotfix or later fixed release;
• backups and images cannot restore an affected build;
• internet reachability is removed;
• logs cover the possible exposure window;
• the indicator is explained;
• unauthorised identities and changes are removed;
• reachable secrets are replaced;
• configuration matches the approved baseline;
• monitoring detects a repeated attempt.

Missing logs are a limitation, not evidence of no attack.

Management-plane architecture after the incident

FMC is not an ordinary web console. It controls devices that enforce traffic policy, so administrative access belongs in a dedicated management zone with a bastion, strong authentication and restricted egress. Network policy should permit specific operational sources only; an organisation-wide VPN is not equivalent to a dedicated administrator path.

After applying the hotfix, test from both directions. The interface should be unreachable from user networks and the internet, while bastion access should appear in central logs with administrator identity. FMC should connect only to documented services, update servers, identity systems and managed firewalls. A new outbound destination should generate an alert.

Configuration backups require encryption, access control and the same secret scope as production. Restoring an old snapshot must not remove the hotfix or recreate static credentials. Restore a copy into isolation, verify its version and only then approve that image for disaster recovery.

This case demonstrates why asset value and exposure can matter more than the CVSS number alone. Low privilege on a management plane may reveal topology, configuration and paths to another stage even when the initial flaw does not immediately provide root access.

Source findings versus Breachroad conclusions

Cisco confirms the static account, active exploitation, product scope, hotfixes, lack of a workaround, indicator and rotation recommendation. CISA confirms KEV status and the federal deadline. Neither source names the actor or publishes the complete observed attack path.

Our detection hypotheses, operating order and chain interpretation are Breachroad analysis. We do not claim every /var/tmp/license.tmp instance means root access or that CVE-2026-20079 was necessarily paired with CVE-2026-20316.

An IT security audit can assess versions, segmentation, identities, backups and management-plane telemetry. Technical-team cybersecurity training helps staff distinguish a base CVSS number from the practical risk of an actively exploited high-value appliance. Maintain campaign context through a disciplined Cyber Threat Intelligence lifecycle.