Cisco Secure FMC Static-Credential Zero-Day Joins CISA KEV

Key Takeaways

Cisco disclosed on July 30, 2026 that Secure Firewall Management Center (FMC) software ships with static credentials tied to a built-in, low-privileged account, and that attackers have already exploited the flaw in the wild [1][2]. The vulnerability, tracked as CVE-2026-20316, lets an unauthenticated remote attacker log into an affected FMC’s web interface using hardcoded credentials and retrieve whatever data that low-privileged account can see [1]. The National Vulnerability Database scored the flaw 5.3, a base score that reflects the compromised account’s low privilege level, but Cisco’s own Product Security Incident Response Team (PSIRT) assigned it a Security Impact Rating of High, reasoning that the access it grants can be chained with other FMC vulnerabilities to escalate privileges on a device that sits at the center of enterprise firewall policy [1][3]. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog on July 29, 2026, giving federal civilian agencies until August 1, 2026 to remediate under CISA’s Binding Operational Directive 26-04, which superseded BOD 22-01 in June 2026 [4][5]. Hotfixes are available now for every affected release line, and organizations running on-premises FMC should treat this as an active-incident-response task rather than routine patch management, checking device logs for the indicator of compromise Cisco has published before assuming they are unaffected [3][6].

Background

Cisco Secure FMC is the centralized management console that administers Cisco’s Secure Firewall (formerly Firepower) appliances, pushing access-control policy, intrusion-prevention signatures, and VPN configuration to every firewall it manages. Because FMC holds the credentials and configuration state for an organization’s entire firewall estate, compromising the management plane can effectively extend an attacker’s reach across every firewall it manages, without needing to attack each device individually. This concentration of trust is precisely why static, unremovable credentials in FMC’s own software are consequential even when the account they unlock is nominally low-privileged: the account still runs inside the same trust boundary that governs the rest of the network.

The flaw was reported to Cisco by security researcher Jimi Sebree of Horizon3.ai, a firm that researches vulnerabilities in enterprise network and security appliances [2][6]. Cisco’s advisory states plainly that “the vulnerability is caused by static credentials for a low-privilege account built into Cisco Secure FMC Software” that exist independent of how an administrator has configured the device [1]. In other words, this is not a misconfiguration that careful deployment practices could have avoided — the credentials are baked into the shipped software itself, meaning every instance of the affected release lines carries the same exposure until patched. Cisco confirmed in its advisory that PSIRT is aware of active exploitation of CVE-2026-20316 in customer environments [3]. CISA added the CVE to its KEV catalog roughly a day later, consistent with its practice of prioritizing actively exploited flaws [4].

The affected surface is specifically the on-premises FMC software; Cisco has confirmed that Cloud-Delivered FMC, Firewall Device Manager, and Secure Firewall ASA Software are not affected by this particular flaw, which narrows the exposure to organizations running self-managed FMC deployments [1][6]. That distinction matters for triage: security teams juggling both cloud-delivered and on-premises Cisco firewall management should confirm which model they run before assuming they need to act.

Security Analysis

The mechanics of CVE-2026-20316 are straightforward: a fixed username and password combination is embedded in FMC’s software and grants access to a low-privileged account without requiring any credentials the customer configured. An attacker with network reachability to the FMC management interface — whether because it is exposed to the internet or reachable from a compromised segment of an internal network — can authenticate directly using those static credentials and retrieve sensitive data available to that account, all without needing to phish an administrator, brute-force a password, or exploit a separate authentication-bypass bug [1][2]. This is the class of vulnerability CWE catalogs as use of hardcoded credentials, a pattern that plausibly recurs when vendors build service accounts for internal software functions and leave credentials static across deployments rather than generating them per instance, though Cisco has not stated why this particular account was implemented this way.

The gap between CVE-2026-20316’s numeric CVSS score and Cisco’s qualitative severity rating illustrates how base CVSS scores can understate risk for infrastructure vulnerabilities whose danger depends on chaining with other flaws. A 5.3 base score reflects that the compromised account is low-privileged and that the attacker gains read access to a bounded set of data rather than administrative control outright. Cisco’s High rating instead reflects what the access enables next: the advisory notes explicitly that the low-privileged foothold “can be combined with other FMC vulnerabilities to elevate privileges,” which means the practical risk to a defender depends on the FMC’s overall patch posture rather than on this vulnerability in isolation [1][3]. Cisco has not published which specific companion vulnerabilities complete that escalation chain, and no independent researcher has publicly demonstrated the full chain, which this note reads as an implicit case for patching comprehensively rather than addressing only CVE-2026-20316 in isolation. Notably, security researchers have flagged that CVE-2026-20079, an FMC authentication-bypass flaw Cisco disclosed in March 2026, shares the same log-based indicator of compromise that Cisco recommends checking for CVE-2026-20316, which suggests the two vulnerabilities may be operationally linked in how attackers are using them even if Cisco has not confirmed a direct technical chain [3].

Cisco has published hotfixes covering every release line it considers affected, summarized in the table below.

Because the credentials are hardcoded rather than configuration-dependent, applying the hotfix is the only remediation path — there is no workaround that removes the exposure short of firewalling off management access entirely, which would disrupt normal administrative operations for most deployments [1][6]. Cisco and downstream researchers have published a specific forensic marker for suspected compromise: reviewing /var/log/messages on the FMC for the string “license” and looking for an execution of package_info.pl that references /var/tmp/license.tmp, which indicates the account may have been used to probe or exfiltrate licensing-related data [3][4]. Asset-visibility vendors have also noted that organizations unsure of their Cisco Secure FMC footprint can query their asset inventories for vendor:=Cisco AND product:=FMC to identify candidate systems needing review, which is a useful first step for larger estates where firewall management infrastructure may not be centrally tracked [6].

Recommendations

Immediate Actions

Security and network operations teams running on-premises Cisco Secure FMC should apply the vendor-supplied hotfix for their release line without delay, treating this as a same-week priority rather than a routine patch cycle given confirmed active exploitation [1][3]. Before or immediately after patching, review /var/log/messages on every affected FMC instance for the package_info.pl / /var/tmp/license.tmp indicator Cisco has published, and escalate to Cisco’s Technical Assistance Center for any instance where that marker is present, since it may indicate the device has already been accessed by an unauthorized party [3][4]. Organizations with FMC management interfaces reachable from the public internet should also confirm that exposure is intentional and, where it is not operationally required, restrict access to trusted management networks while the hotfix is validated in their environment.

Short-Term Mitigations

Once the hotfix is applied, teams should rotate credentials, API keys, and certificates associated with the affected FMC instances, particularly if any exploitation indicator was found, since a low-privileged foothold that persisted even briefly could have been used to harvest secrets or reconnaissance data ahead of a follow-on attack [4]. Organizations should also confirm the patch status of other recently disclosed FMC vulnerabilities, including CVE-2026-20079, given Cisco’s own warning that this flaw’s risk is compounded when combined with other unpatched issues on the same device [1][3]. Federal civilian agencies subject to CISA’s KEV catalog obligations must complete remediation by the August 1, 2026 deadline, and should document that completion per CISA’s BOD 26-04 reporting requirements, which superseded BOD 22-01 in June 2026 [4][5].

Strategic Considerations

Beyond this specific advisory, FMC now joins at least one other 2026 case of hardcoded-credential exposure in security appliances, such as the actively exploited FortiSandbox vulnerabilities CSA examined earlier this year [7], a recurrence that argues for treating vendor attestations about built-in service accounts as a standing procurement and renewal question rather than a one-time due-diligence check. Security teams should ask vendors directly whether any built-in account uses static, non-rotatable credentials, and should weight that answer in vendor risk assessments for any appliance that sits in a privileged management position, such as firewall managers, SIEM collectors, and identity providers. Where static service accounts cannot be eliminated by the vendor, network architecture should assume they exist and constrain what any single account — however low its nominal privilege — can reach, consistent with a zero trust posture that limits lateral reachability into management planes rather than relying on the assumption that internal network position implies trustworthiness.

CSA Resource Alignment

This incident sits within a broader 2026 pattern of active exploitation against security appliances that organizations trust precisely because of the privileged position they occupy in the network, a pattern CSA examined directly in FortiSandbox Triple-CVE: Security Appliances as Network Entry Points [7]. That research note analyzed three actively exploited FortiSandbox vulnerabilities and made the same underlying point this advisory reinforces: a device deployed to enforce security policy becomes a high-value entry point the moment it is itself compromised, and the compounding risk of chained vulnerabilities on such devices — exactly the dynamic Cisco warns about with CVE-2026-20316 — deserves more remediation urgency than a single CVSS score in isolation suggests. This same pattern is also directly on point for FMC itself: CSA’s earlier research note on Interlock’s 45-Day Zero-Day: CVE-2026-20131 examined a pair of “twin CVSS 10.0” FMC vulnerabilities — CVE-2026-20131 and CVE-2026-20079, the same companion CVE this note links to CVE-2026-20316 via a shared indicator of compromise — that together provided redundant unauthenticated root access to the management plane, reinforcing that FMC’s vulnerability history is one of compounding, not isolated, risk [10].

The static-credential root cause also connects directly to CSA’s Zero Trust Principles and Guidance for Identity and Access Management [8], which argues that access decisions should never rely on an account’s mere existence inside a trusted boundary and instead should be continuously verified and scoped to least privilege regardless of network position. Applied here, that guidance supports the strategic recommendation above: even a low-privileged built-in account should be constrained by network segmentation and monitored access rather than implicitly trusted because it lives inside the management plane. Finally, this vulnerability’s lifecycle — from hardcoded credential, to active exploitation, to KEV listing, to a compressed federal remediation deadline — maps onto control objectives in CSA’s AI Controls Matrix (AICM) v1.1, particularly those addressing vulnerability intake and time-bound remediation tracking, which apply to the infrastructure underpinning AI workloads even when that infrastructure is not itself an AI system [9]. Organizations that manage AI workloads behind Cisco-firewalled network segments should treat this advisory as a reminder that the security of the perimeter management plane is a precondition for the security of everything it protects, AI infrastructure included.

References

[1] Cisco. “Cisco Secure Firewall Management Center Software Static Credential Vulnerability.” Cisco Security Advisories, July 30, 2026.

[2] Bill Toulas. “Cisco warns of FMC static credential flaw exploited in zero-day attacks.” BleepingComputer, July 30, 2026.

[3] Zeljka Zorz. “Cisco FMC static credentials exploited by attackers (CVE-2026-20316).” Help Net Security, July 30, 2026.

[4] “Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data.” The Hacker News, July 30, 2026.

[5] “U.S. CISA adds a Cisco Secure Firewall Management Center (FMC) flaw to its Known Exploited Vulnerabilities catalog.” Security Affairs, July 29, 2026.

[6] “Cisco Secure FMC vulnerability CVE-2026-20316: Find impacted assets.” runZero Blog, July 30, 2026.

[7] Cloud Security Alliance. “FortiSandbox Triple-CVE: Security Appliances as Network Entry Points.” CSA AI Safety Initiative, June 17, 2026.

[8] Cloud Security Alliance. “Zero Trust Principles and Guidance for Identity and Access Management (IAM).” CSA, 2024.

[9] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, 2026.

[10] Cloud Security Alliance. “Interlock’s 45-Day Zero-Day: CVE-2026-20131.” CSA AI Safety Initiative, March 20, 2026.