Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation. The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log
Analysis Summary
# Vulnerability: Active Exploitation of Static Credentials in Cisco Secure FMC
## CVE Details
- **CVE ID:** CVE-2026-20316
- **CVSS Score:** 5.3 (Medium) - *Note: Cisco assigns a High Security Impact Rating (SIR) due to chaining potential.*
- **CWE:** CWE-798 (Use of Hard-coded Credentials)
## Affected Systems
- **Products:** Cisco Secure Firewall Management Center (FMC) Software
- **Versions:**
- 7.0
- 7.2
- 7.4
- 7.6
- 7.7
- 10.0
- **Configurations:** Systems where the FMC management interface is accessible (risk is higher if exposed to the public internet).
## Vulnerability Description
The vulnerability exists due to the presence of static user credentials for a low-privileged account within the Cisco Secure FMC Software. An unauthenticated, remote attacker can use these hard-coded credentials to log in to the management interface of an affected device. Once logged in, the attacker can access sensitive data accessible to that low-privileged user account.
## Exploitation
- **Status:** **Exploited in the wild** (Zero-day; added to CISA KEV catalog).
- **Complexity:** Low
- **Attack Vector:** Network
- **Chaining Potential:** This vulnerability can be chained with CVE-2026-20079 (an authentication bypass flaw) to potentially gain root access and execute arbitrary scripts.
## Impact
- **Confidentiality:** Partial (Access to sensitive data via low-privilege account).
- **Integrity:** None (Directly via CVE-2026-20316, though chaining increases risk).
- **Availability:** None
## Remediation
### Patches
Cisco has released hotfixes for the following branches:
- **7.0:** Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
- **7.2:** Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
- **7.4:** Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
- **7.6:** Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
- **7.7:** Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
- **10.0:** Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar
### Workarounds
- **Strict Access Control:** Ensure the FMC management interface is not accessible from the public internet. Restrict access to trusted internal networks only.
- **Urgent Patching:** CISA mandates FCEB agencies apply fixes by August 1, 2026.
## Detection
**Indicators of Compromise (IoC):**
Administrators can check for potential exploitation by entering expert mode in the CLI and running:
`cat /var/log/messages | grep license`
**Positive Match:**
If the output includes references to `/var/tmp/license.tmp`, the system may have been compromised.
*Example observed in the wild:*
`Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm`
## References
- **Cisco Security Advisory (CVE-2026-20316):** hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
- **Cisco Security Advisory (CVE-2026-20079):** hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog