# Cisco Firewall Management Center Zero-Day Exploited via Hardcoded Login

Page: https://hirantha.me/blog/cisco-firewall-management-center-zero-day-exploited-via-hardcoded-login
Published: 2026-08-03
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: cisco, zero-day, firewall, vulnerability-management, network-security

> Attackers are already using a hardcoded low-privilege account in Cisco's Secure Firewall Management Center to break in, CISA confirms.

## A password nobody was supposed to have

Cisco's Secure Firewall Management Center (FMC), the console many enterprises use to administer their firewalls, shipped with a built-in account whose login credentials were static rather than unique per install. Cisco disclosed on July 30, 2026 that attackers found it first: the flaw, tracked under the identifier CVE-2026-20316 (Common Vulnerabilities and Exposures), is already being exploited in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog the day before, on July 29.

The account in question is low-privilege, which is why Cisco's own severity math gives the bug a CVSS (Common Vulnerability Scoring System) score of only 5.3. But Cisco rates the real-world impact as High, because an unauthenticated, remote attacker can use the static credentials to log in and pull sensitive data straight off the box, and because the access becomes far more dangerous when combined with other flaws in the same product to escalate privileges.

## What's affected

The bug lives in Cisco Secure FMC Software versions 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. It does not touch Cloud-Delivered FMC, Firewall Device Manager, Cisco's Adaptive Security Appliance (ASA) Software, Secure Firewall Threat Defense Software, or Security Cloud Control.

The flaw was reported by researcher Jimi Sebree of Horizon3.ai. Cisco's own product security team says it learned of active exploitation attempts in early July, roughly three weeks before it shipped a fix.

## No workaround, just a hotfix

Cisco is not offering a configuration workaround for CVE-2026-20316. The only fix is the hotfix Cisco released on July 30. Administrators who cannot patch immediately are advised to at least pull the FMC management interface off the public internet, which Cisco says meaningfully shrinks the pool of attackers who can reach the flaw at all.

For anyone checking whether they were already hit, Cisco has published an indicator of compromise: look in `/var/log/messages` in expert mode for entries showing the `package_info.pl` script running in connection with a file called `/var/tmp/license.tmp`. If that shows up, Cisco's advice is to treat the device as compromised, rotate every credential, key and certificate stored on it, and open a case with the Cisco Technical Assistance Center (TAC) before doing anything else.

Because CVE-2026-20316 is now in CISA's Known Exploited Vulnerabilities catalog, U.S. federal civilian agencies were required to remediate it by August 1, 2026, two days after the catalog listing went live. That is an unusually tight turnaround even by KEV standards, and it reflects how CISA is treating a static-credential bug that is already being used against real targets.

## The unexplained sibling bug

What makes this one harder to reason about is a second, far more severe FMC flaw sitting next to it. CVE-2026-20079, disclosed back in March 2026, is a critical authentication bypass in the same product with a maximum CVSS score of 10.0, exploitable with no credentials at all. Cisco has not confirmed malicious exploitation of that bug, but security researchers have noted that it shares an indicator of compromise with the newly exploited CVE-2026-20316, and Cisco has not explained what, if any, relationship exists between the two. A third FMC bug from the same March batch, CVE-2026-20131, is a remote code execution flaw in the same software line.

Taken together, that is three distinct FMC vulnerabilities disclosed within a few months of each other, one of which is now confirmed under active attack. For a product that sits in front of an organization's firewall estate and effectively holds the keys to it, that concentration of findings is itself worth noting, independent of any single CVE (Common Vulnerabilities and Exposures) entry.

## What this means for administrators

If your organization runs Secure FMC on any of the affected 7.x or 10.0 releases, the hotfix is not optional homework for the next maintenance window. The combination of a public exploit already in circulation, a KEV listing, and a federal patch deadline that has already passed puts this squarely in apply-now territory. Check the FMC management interface's internet exposure first, since that single step reduces risk immediately even before a patch window opens, then work through Cisco's log-review steps to rule out a prior compromise, and rotate credentials if there is any doubt.

Given the unresolved link to CVE-2026-20079, treat this as a prompt to review exposure to all three recent FMC vulnerabilities together rather than patching one CVE and considering the job done.

## Questions

**What is CVE-2026-20316?**
It is a high-severity flaw in Cisco Secure Firewall Management Center (FMC) caused by static login credentials built into a low-privilege account, letting an unauthenticated attacker log in remotely and read sensitive data.

**Which Cisco products are affected?**
FMC software versions 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Cloud-Delivered FMC, Firewall Device Manager, ASA Software, Secure Firewall Threat Defense Software and Security Cloud Control are not affected.

**How do I know if my FMC has been compromised?**
Check /var/log/messages in expert mode for entries tied to the package_info.pl script referencing /var/tmp/license.tmp; Cisco lists this as the indicator of compromise for active exploitation.

**Is there a workaround if I can't patch immediately?**
No official workaround exists, but restricting the FMC management interface from public internet access reduces the exposed attack surface until the hotfix is applied.

**How does this relate to CVE-2026-20079?**
CVE-2026-20079 is a separate, more severe (CVSS 10.0) authentication bypass in FMC disclosed in March 2026; Cisco has not clarified the relationship between the two bugs despite them sharing an indicator of compromise.

## Sources

- [Cisco warns of FMC static credential flaw exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/), BleepingComputer
- [Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data](https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html), The Hacker News
- [Cisco FMC static credentials exploited by attackers (CVE-2026-20316)](https://www.helpnetsecurity.com/2026/07/30/cisco-fmc-cve-2026-20316-exploited/), Help Net Security
- [Cisco Secure FMC Zero-Day Exploited in the Wild](https://www.securityweek.com/cisco-secure-fmc-zero-day-exploited-in-the-wild/), SecurityWeek