CISA Orders Emergency Patching For Cisco FMC Zero-Day Exploited Through Static Credentials

A newly disclosed vulnerability in Cisco Secure Firewall Management Center is being actively exploited in attacks, prompting the US Cybersecurity and Infrastructure Security Agency to order federal agencies to apply emergency fixes within days.

Tracked as CVE-2026-20316, the vulnerability allows an unauthenticated remote attacker to sign in to an affected Firewall Management Center, or FMC, appliance using static credentials associated with a low-privilege account. Once authenticated, the attacker may access sensitive information available to that account and potentially use the foothold alongside other vulnerabilities to gain broader control of the management system.

Cisco disclosed the flaw on July 29 after its Product Security Incident Response Team learned that attackers had been exploiting it during July. CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities Catalog, requiring US Federal Civilian Executive Branch agencies to complete remediation by August 1, 2026.

Although CVE-2026-20316 carries a comparatively modest CVSS severity score of 5.3, Cisco has classified the vulnerability as High severity because of the potential for attackers to combine it with other FMC weaknesses and escalate their privileges.

The distinction highlights an important limitation of assessing vulnerabilities solely through their base severity scores. On its own, CVE-2026-20316 provides only low-privileged access and has no documented direct impact on system integrity or availability. In a real attack, however, authenticated access to a security-management appliance can expose information, functionality and internal interfaces that help an intruder identify additional routes to compromise.

Cisco said there are no workarounds that fully address the vulnerability. Organisations running affected FMC releases must install the appropriate hot fix or move to a fixed software release.

Cisco Secure Firewall Management Center is used to centrally configure, monitor and administer Cisco Secure Firewall deployments. Depending on the environment, an FMC system may manage access-control policies, intrusion-prevention settings, security events, network objects, device configurations and other operational data across multiple firewalls.

That position makes the platform a particularly sensitive target. An attacker who compromises a firewall-management system may gain valuable intelligence about the organisation’s network architecture and defensive controls, even if the initially compromised account has restricted permissions.

According to Cisco’s security advisory, the vulnerability exists because affected FMC software contains static credentials for a low-privileged account. An unauthenticated attacker who can reach the management interface can use those credentials to log in and access sensitive data available to the embedded account.

The attack requires no prior authentication and no interaction from an administrator. Cisco’s CVSS assessment describes the attack as remotely exploitable over a network, with low complexity and no user interaction.

Cisco has not publicly identified the exposed account, disclosed the credentials or described precisely which data can be accessed after authentication. It has also withheld technical details about the observed attacks, including the identity of the threat actors, the number or type of victims and the date on which exploitation began.

Security researcher Jimi Sebree of Horizon3.ai discovered and reported the vulnerability to Cisco.

CVE-2026-20316 received a CVSS score of 5.3 because the documented direct impact is limited to confidentiality. The score assumes that successful exploitation gives an attacker access as a low-privileged user but does not, by itself, allow data modification, service disruption or administrative control.

Cisco nevertheless elevated the vulnerability to a High Security Impact Rating because attackers may be able to chain the initial access with other weaknesses in FMC software to elevate privileges.

This means the static credentials may function less as the final objective of an intrusion and more as an entry point. Once inside the web interface, an attacker could potentially reach functionality that is inaccessible to unauthenticated users, collect system information, study the appliance’s configuration or attempt to exploit a second vulnerability that requires some level of access.

The risk is amplified by FMC’s role as a central control point. Information accessible through the platform could reveal managed devices, security policies, internal addresses, software versions, logging configurations or other data capable of supporting lateral movement and follow-on attacks.

Cisco has not publicly confirmed which additional vulnerabilities have been used with CVE-2026-20316. Organisations should therefore avoid treating a low-privileged login as a contained or low-impact event, particularly if the FMC management interface was reachable from the internet.

The disclosure coincided with a major update to Cisco’s March advisory for CVE-2026-20079, a separate critical authentication-bypass vulnerability affecting Cisco Secure FMC Software.

CVE-2026-20079 carries the maximum CVSS score of 10.0 and allows an unauthenticated remote attacker to send crafted HTTP requests to an affected system, bypass authentication and execute scripts or commands with root privileges on the underlying operating system.

Cisco attributes that vulnerability to an improper system process created when the appliance starts. Successful exploitation can provide complete control of the FMC system without requiring credentials or user interaction.

The company updated the CVE-2026-20079 advisory on July 29 to add a second Cisco bug identifier, CSCwt95974, along with new hot fixes and the same indicator of compromise published for CVE-2026-20316.

The overlap raises the possibility that the vulnerabilities are operationally connected. In particular, both advisories instruct administrators to search for activity involving a temporary file named:

However, Cisco has not confirmed publicly that attackers are chaining CVE-2026-20316 with CVE-2026-20079. The shared indicator demonstrates a technical relationship or overlapping exploitation path, but it is not sufficient on its own to prove that the critical authentication bypass has been maliciously exploited.

Cisco continues to say that it is not aware of malicious exploitation of CVE-2026-20079. That position differs from CVE-2026-20316, for which the company has explicitly confirmed active exploitation.

The distinction is important for incident reporting. Organisations should investigate both vulnerabilities when the indicator is present, but should not assume that every detection proves exploitation of both flaws.

Cisco has provided a command that administrators can run from FMC expert mode to determine whether the appliance contains the disclosed indicator.

cat /var/log/messages | grep license        

A potentially compromised system may return an entry resembling:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm        

The entry shows the web-service account invoking Cisco’s package_info.pl utility as root and supplying /var/tmp/license.tmp as an argument.

Cisco describes the presence of that path as an indication that the vulnerability “may have been exploited,” rather than definitive proof of compromise. Its absence should likewise not be treated as proof that a system is clean. Logs may have rotated, been deleted or been altered after an intrusion, and an attacker may have used variations that do not leave the exact published artefact.

If the entry is found, Cisco advises customers to contact the Cisco Technical Assistance Center for help evaluating recovery options. The company also recommends rotating all user credentials, cryptographic keys and certificates stored on the affected FMC device because active exploitation has been underway.

That response goes beyond simply changing the password of the low-privileged account. If an attacker reached root privileges or extracted secrets from the appliance, installing the hot fix alone would close the original vulnerability without invalidating credentials or cryptographic material already obtained by the attacker.

Cisco has released hot fixes covering FMC releases 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.

The same set of hot fixes is now listed in Cisco’s updated advisory for CVE-2026-20079. Administrators should confirm that they are applying the correct package for their installed release and follow Cisco’s Firepower hot-fix instructions.

Cisco recommends using its Software Checker to establish which advisories affect a specific software build and identify the earliest release that resolves all applicable vulnerabilities. This matters because an environment may be exposed to multiple FMC flaws, and installing a fix for one vulnerability does not necessarily address every weakness present in the installed branch.

There is no configuration workaround that eliminates CVE-2026-20316. Restricting network access to the management interface reduces exposure but does not remove the vulnerable static account or protect against an attacker who already has access to the management network.

Cisco said CVE-2026-20316 affects Secure FMC Software regardless of how the appliance is configured.

The company has confirmed that the following products and services are not vulnerable to this specific static-credential flaw:

• Cloud-Delivered Firewall Management Center
• Firewall Device Manager
• Secure Firewall Adaptive Security Appliance Software
• Secure Firewall Threat Defense Software
• Security Cloud Control, formerly Cisco Defense Orchestrator

The separate CVE-2026-20079 vulnerability affects both FMC Software and Cisco Security Cloud Control Firewall Management. Cisco said it has already deployed the necessary correction to the software-as-a-service environment, meaning Security Cloud Control customers do not need to perform a manual update for that flaw.

Cisco noted that the attack surface is reduced when the FMC management interface is not publicly accessible. Organisations should ensure that administration services are reachable only through tightly controlled management networks, approved jump hosts or secured remote-access infrastructure.

Removing direct internet exposure is an important containment measure, particularly while emergency patching is underway. It is not a replacement for installing Cisco’s fixes.

An appliance without a publicly reachable interface can still be attacked by an adversary who has compromised a VPN account, administrator workstation, internal server or another system with access to the management network. Static credentials also remain valid until the underlying vulnerable software is corrected.

Security teams should therefore evaluate exposure more broadly than a simple public-IP scan. Reviews should include firewall rules, network address translation, VPN-access policies, cloud security groups, administrative proxies and any internal routes through which an attacker could reach FMC’s web interface.

CISA’s decision to add CVE-2026-20316 to the Known Exploited Vulnerabilities catalog means the agency considers there to be reliable evidence of exploitation in real-world attacks.

Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalogued vulnerabilities by the specified deadline. For CVE-2026-20316, that deadline is August 1—only days after Cisco publicly released its advisory.

The unusually short window reflects the urgency created by confirmed exploitation and the security-critical position occupied by FMC appliances. Although CISA’s directive applies directly to US federal civilian agencies, the KEV catalog is also widely used by private-sector organisations as a vulnerability-prioritisation tool.

Enterprises should not interpret the federal deadline as a safe waiting period. Any organisation operating a vulnerable and reachable FMC appliance should treat the issue as an emergency change, especially when the management interface has been exposed to the public internet.

For organisations with potentially affected systems, the response should include both vulnerability remediation and compromise assessment.

Administrators should first identify every FMC deployment, document its software release and determine whether its management interface is reachable from the internet or other untrusted networks. They should then preserve relevant logs before installing the hot fix, search for the published /var/tmp/license.tmp indicator and investigate suspicious authentication or administrative activity.

Any system showing evidence consistent with exploitation should be treated as potentially compromised at the appliance level. Cisco recommends rotating all user credentials, keys and certificates associated with the device and contacting TAC for recovery assistance.

Security teams should also examine connected systems. Because FMC centrally manages firewall infrastructure, investigators may need to review policy changes, administrator accounts, configuration exports, managed-device communications and activity originating from the management appliance.

If attackers achieved root access, organisations should consider whether the integrity of the system can be established through log review alone. Recovery may require a more extensive rebuild or restoration process developed with Cisco rather than simply applying the hot fix to a suspected compromised appliance.

Cisco has not disclosed who is exploiting CVE-2026-20316, how many organisations have been affected or whether the attacks are linked to cyberespionage, ransomware, credential theft or another objective.

It has also not explained how attackers obtained the static credentials or whether knowledge of them had circulated privately before the advisory was published. No public proof-of-concept exploit was identified in Cisco’s initial notice.

The relationship between CVE-2026-20316 and the critical CVE-2026-20079 flaw also remains unclear. The shared hot fixes, additional bug identifier and matching indicator warrant close attention, but Cisco’s advisories stop short of stating that the two vulnerabilities have been chained in observed attacks.

For defenders, the absence of full attack details increases rather than reduces the need for rapid action. Confirmed exploitation, the lack of a workaround and the possibility of privilege escalation make the vulnerability substantially more dangerous than its 5.3 CVSS score may initially suggest.

Organisations running Cisco Secure Firewall Management Center should install the relevant fix immediately, restrict management access, search for the published indicator and begin a deeper incident investigation wherever suspicious activity is found.

Frontier AI models are now finding healthcare vulnerabilities before a CVE exists. The exploit window used to be weeks. Now it is hours. Most security programs wait for a CVE to trigger the patch cycle. Mythos and Frontier AI based exploits skip that step entirely.

In this webinar, you’ll learn:

• ✅ How to meet the HIPAA NPRM 15-day patch mandate without disrupting clinical workflows
• ✅ How to govern BYOD and shared devices
• ✅ How to extend endpoint protection to telehealth, RPM, and home-care workers
• ✅ How to detect and contain open-source supply-chain threats such as npm and PyPI credential attacks that target EHR integrations and telehealth portals
• ✅ A multi-layered exposure management approach to pre-CVE exploitations that leverage frontier AI models such as Mythos
• ✅ A custom CISO dashboard built for healthcare