Cisco warns of FMC static credential flaw exploited in zero-day attacks
Cisco warns of a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, which was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.
Intelligence analysis by Llama
Cisco has released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 to address the vulnerability, which affects Cisco Secure FMC Software regardless of device configuration.
Imagine you have a super important password that you use to log in to a special computer. But, someone found out what that password is and can use it to get into the computer without you knowing. This is what happened with Cisco's Secure Firewall Management Center (FMC) software. Someone found out the password and used it to get into the computer, which is a big problem because it could let them access sensitive information.
Analysis
A Critical Flaw in Cisco Secure FMC Software
Cisco has warned of a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, which was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices. The vulnerability is caused by static credentials for a low-privilege account built into Cisco Secure FMC Software. An unauthenticated, remote attacker can use these credentials to log in to an affected system and access sensitive data available to the account. While CVE-2026-20316 has a CVSS score of 5.3, Cisco assigned it a High severity rating because the access can be combined with other FMC vulnerabilities to elevate privileges. However, the company has not identified the additional vulnerabilities or explained how they are being used in attacks.
The Impact of the Flaw
The flaw affects Cisco Secure FMC Software regardless of device configuration, but does not impact Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, or Security Cloud Control. Cisco has released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds that address the vulnerability, and customers are strongly advised to install the available fixes. Cisco says it became aware of active exploitation in July 2026 but has not shared when the attacks began, who is behind them, or what organizations were targeted. Jimi Sebree of Horizon3.ai reported the vulnerability. The company notes that the attack surface is reduced when the FMC management interface is not exposed to the public internet.
Detecting Compromised Devices
To detect whether a Cisco FMC installation was compromised, administrators should review the /var/log/messages log file for signs that the vulnerability may have been exploited. Administrators can search for suspicious activity by running the following command in expert mode: cat /var/log/messages | grep license Cisco says a log entry containing /var/tmp/license.tmp, as shown below, may indicate that an FMC device was compromised: Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm The log entry shows the FMC web process, running under the www account, invoking Cisco's package_info.pl script as root and supplying the /var/tmp/license.tmp file. If a device contains this IOC, admins should rotate all user credentials, keys, and certificates on the affected FMC device because exploitation has been ongoing. Organizations that believe they are compromised should also contact the Cisco TAC for assistance with recovery.
Key points
- Cisco has warned of a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, which was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.
- The vulnerability affects Cisco Secure FMC Software regardless of device configuration, but does not impact Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, or Security Cloud Control.
- Cisco has released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 to address the vulnerability.
- Administrators should review the /var/log/messages log file for signs that the vulnerability may have been exploited and rotate all user credentials, keys, and certificates on the affected FMC device if exploitation has been ongoing.
If organizations install the available hot fixes and rotate their user credentials, keys, and certificates on the affected FMC devices, they can mitigate the risk of exploitation and prevent further attacks.
The fact that the vulnerability was actively exploited in zero-day attacks and that Cisco has not identified the additional vulnerabilities or explained how they are being used in attacks suggests that the risk of exploitation is high and that further attacks are likely.
