Cisco Ships Hotfixes for FMC Zero-Day CVE-2026-20316 as CISA Sets August 1 Deadline

Cisco has confirmed that attackers are exploiting a hardcoded-credential flaw in Secure Firewall Management Center (FMC) as a zero-day. CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog on Wednesday, July 29, and set a remediation deadline of August 1, 2026 for Federal Civilian Executive Branch agencies. That is a three-day window, which is as strong a signal as CISA gives that the exploitation is real and ongoing.

The vulnerability itself carries a CVSS score of only 5.3. Ignore that number. Cisco assigned the advisory a Security Impact Rating of High rather than Medium specifically because the flaw can be chained with other FMC vulnerabilities to elevate privileges. The CVSS score describes what one bug does in isolation; it does not describe what an attacker does with it.

What the flaw actually is

CVE-2026-20316 exists because Cisco Secure FMC Software ships with static user credentials for a low-privileged account. An unauthenticated, remote attacker can use that account to log in to an affected device and access sensitive data as that user. There is no exploit development required, no memory corruption, no race condition. The credentials are in the product. An attacker who knows them types them in.

Security researcher Jimi Sebree of Horizon3.ai discovered and reported the flaw. Cisco acknowledged that exploitation began earlier this month but has not disclosed the start date, attribution, or the mechanics of the observed attacks.

Cisco notes that the attack surface is reduced if the FMC management interface has no public internet access. That is accurate and it is the single highest-value compensating control here, but treat it as risk reduction rather than immunity. FMC is the management plane for your firewall estate. Anything that reaches your management VLAN, including a compromised jump host or a contractor VPN segment, reaches the login prompt.

The chain is the real story

On the same day, Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Secure FMC Software with a CVSS score of 10.0. The update added a second bug ID (CSCwt95974), the same hotfixes, and, notably, the same indicators of compromise.

CVE-2026-20079 allows execution of arbitrary executable script files to obtain root access. Cisco says it is not aware of malicious exploitation of that flaw. But the two advisories now point at an identical forensic artifact, which strongly suggests the two can be chained: static credentials get an attacker onto the box, and the auth bypass turns that foothold into root on the device that manages your firewall policy.

Hunt for this now

Cisco published a concrete IoC. From expert mode on the FMC CLI, run the following and inspect the output for the string /var/tmp/license.tmp:

cat /var/log/messages | grep license

A hit looks like this sample from Cisco's advisory: Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm. Two details matter in that line. The www user is the web service account, and the command runs as root. If you see it, you are looking at a web-facing process invoking a root command against an attacker-controllable temp file.

• Run the grep on every FMC appliance and virtual instance, not just internet-facing ones.
• Preserve /var/log/messages before patching. Hotfix installation and log rotation both destroy evidence.
• Cross-reference the timestamp of any hit against FMC audit logs for policy pushes, user creation, and object changes.
• If you find the artifact, assume the credentials of every account that touched the FMC in that window are exposed and rotate them.
• Check managed FTD and ASA devices for configuration drift that did not originate from a change ticket.

Patch versions

Cisco addressed both issues in hot fix releases across six branches. There is no partial fix and no configuration workaround that eliminates the credentials:

• 7.0 — Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
• 7.2 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
• 7.4 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
• 7.6 — Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
• 7.7 — Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
• 10.0 — Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Why this keeps happening to security appliances

Static credentials in a shipping product are a class of defect that should not survive a modern SDLC, yet network security appliances keep producing them. The pattern is familiar: an internal service account gets a fixed password for provisioning or licensing convenience, the account never gets rotated per-install, and it ships to every customer identically. Once one researcher or one attacker extracts it from firmware, every deployment on earth shares the same password.

The operational lesson is not about Cisco. It is that management planes for security tooling deserve the same segmentation discipline you apply to domain controllers. FMC, vCenter, your EDR console, your SIEM admin interface: each one is a single system whose compromise translates directly into control over the defenses it manages. If your FMC management interface is reachable from a user VLAN, from a VPN pool, or from the internet, that architecture is the finding, and CVE-2026-20316 is just the demonstration.

What to do this week

• Inventory every FMC instance and record its software branch. Virtual appliances in cloud environments are routinely missed.
• Run the license grep and preserve output with timestamps before any change.
• Apply the branch-appropriate hotfix. FCEB agencies have until August 1, 2026; everyone else should treat that as the reasonable bar.
• Confirm the FMC management interface is not internet-reachable using external scan data, not a firewall rule review.
• Add both CVE-2026-20316 and CVE-2026-20079 to your vulnerability tracking with the chain relationship documented, so the 5.3 score does not send the first one to a 30-day queue.