A password nobody was supposed to have
Cisco's Secure Firewall Management Center (FMC), the console many enterprises use to administer their firewalls, shipped with a built-in account whose login credentials were static rather than unique per install. Cisco disclosed on July 30, 2026 that attackers found it first: the flaw, tracked under the identifier CVE-2026-20316 (Common Vulnerabilities and Exposures), is already being exploited in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog the day before, on July 29.
The account in question is low-privilege, which is why Cisco's own severity math gives the bug a CVSS (Common Vulnerability Scoring System) score of only 5.3. But Cisco rates the real-world impact as High, because an unauthenticated, remote attacker can use the static credentials to log in and pull sensitive data straight off the box, and because the access becomes far more dangerous when combined with other flaws in the same product to escalate privileges.
What's affected
The bug lives in Cisco Secure FMC Software versions 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. It does not touch Cloud-Delivered FMC, Firewall Device Manager, Cisco's Adaptive Security Appliance (ASA) Software, Secure Firewall Threat Defense Software, or Security Cloud Control.
The flaw was reported by researcher Jimi Sebree of Horizon3.ai. Cisco's own product security team says it learned of active exploitation attempts in early July, roughly three weeks before it shipped a fix.
No workaround, just a hotfix
Cisco is not offering a configuration workaround for CVE-2026-20316. The only fix is the hotfix Cisco released on July 30. Administrators who cannot patch immediately are advised to at least pull the FMC management interface off the public internet, which Cisco says meaningfully shrinks the pool of attackers who can reach the flaw at all.
For anyone checking whether they were already hit, Cisco has published an indicator of compromise: look in /var/log/messages in expert mode for entries showing the package_info.pl script running in connection with a file called /var/tmp/license.tmp. If that shows up, Cisco's advice is to treat the device as compromised, rotate every credential, key and certificate stored on it, and open a case with the Cisco Technical Assistance Center (TAC) before doing anything else.
Because CVE-2026-20316 is now in CISA's Known Exploited Vulnerabilities catalog, U.S. federal civilian agencies were required to remediate it by August 1, 2026, two days after the catalog listing went live. That is an unusually tight turnaround even by KEV standards, and it reflects how CISA is treating a static-credential bug that is already being used against real targets.
The unexplained sibling bug
What makes this one harder to reason about is a second, far more severe FMC flaw sitting next to it. CVE-2026-20079, disclosed back in March 2026, is a critical authentication bypass in the same product with a maximum CVSS score of 10.0, exploitable with no credentials at all. Cisco has not confirmed malicious exploitation of that bug, but security researchers have noted that it shares an indicator of compromise with the newly exploited CVE-2026-20316, and Cisco has not explained what, if any, relationship exists between the two. A third FMC bug from the same March batch, CVE-2026-20131, is a remote code execution flaw in the same software line.
Taken together, that is three distinct FMC vulnerabilities disclosed within a few months of each other, one of which is now confirmed under active attack. For a product that sits in front of an organization's firewall estate and effectively holds the keys to it, that concentration of findings is itself worth noting, independent of any single CVE (Common Vulnerabilities and Exposures) entry.
What this means for administrators
If your organization runs Secure FMC on any of the affected 7.x or 10.0 releases, the hotfix is not optional homework for the next maintenance window. The combination of a public exploit already in circulation, a KEV listing, and a federal patch deadline that has already passed puts this squarely in apply-now territory. Check the FMC management interface's internet exposure first, since that single step reduces risk immediately even before a patch window opens, then work through Cisco's log-review steps to rule out a prior compromise, and rotate credentials if there is any doubt.
Given the unresolved link to CVE-2026-20079, treat this as a prompt to review exposure to all three recent FMC vulnerabilities together rather than patching one CVE and considering the job done.
