Skip to content

Cisco Secure FMC CVE-2026-20316 static-credential exploitation

Summary

On 2026-07-29, Cisco disclosed active exploitation of CVE-2026-20316, a static-credential vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC), formerly Firepower Management Center. An unauthenticated remote attacker can use the embedded low-privilege account to log in and access sensitive data. Cisco rates the issue High despite its CVSS 3.1 base score of 5.3 because it can be chained with other Secure FMC vulnerabilities to elevate privileges.

CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day and set a 2026-08-01 remediation due date under BOD 26-04. Cisco says exploitation has been ongoing, provides a host-log indicator involving /var/tmp/license.tmp, recommends rotating every user credential, key, and certificate on suspected devices, and has released hot fixes for supported 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 branches. There is no workaround.

Tags

Why this matters

  • Secure FMC is a firewall-management control plane. Even though the exposed account is low privilege, access to management data and chaining with other FMC flaws can enable much broader compromise.
  • Cisco's advisory does not limit the vulnerable condition to a special configuration: Secure FMC Software is affected regardless of device configuration. Removing public access reduces the reachable attack surface but does not remove the vulnerable credential.
  • Cisco has confirmed active exploitation rather than only scanning or proof-of-concept availability.
  • Patching is necessary but insufficient where exploitation may have occurred. Cisco's minimum response includes rotating all device user credentials, keys, and certificates, which implies potential exposure of multiple trust relationships.

Vulnerability and scope

CVE-2026-20316 is caused by static credentials for a low-privilege account in the Secure FMC web interface. Exploitation requires no prior authentication or user interaction and can be performed remotely over the network. A successful attacker can authenticate to the affected system and access sensitive data available to that account.

Cisco assigned:

  • advisory ID cisco-sa-fmc-static-cred-BET3Cjh;
  • bug ID CSCwt95997;
  • weakness CWE-259, use of hard-coded password; and
  • CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3.

Cisco raised the Security Impact Rating to High because the vulnerability can be combined with other Secure FMC vulnerabilities for privilege elevation. The public advisory does not identify the companion flaws or attribute the observed exploitation to a named actor. CISA records ransomware-campaign use as unknown.

Affected and unaffected products

Cisco says the vulnerability affects Secure FMC Software regardless of configuration. The vendor publishes hot fixes for the supported 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 release families.

Cisco explicitly lists these products as not vulnerable:

  • Cloud-Delivered FMC (cdFMC);
  • Firewall Device Manager (FDM);
  • Secure Firewall Adaptive Security Appliance (ASA) Software;
  • Secure Firewall Threat Defense (FTD) Software; and
  • Security Cloud Control (SCC), formerly Defense Orchestrator.

Do not infer that an on-premises FMC is safe because its managed firewalls run unaffected ASA or FTD software; the vulnerable component is the separate management system.

Exploitation evidence and investigation pivot

Cisco PSIRT says it became aware of active exploitation in July 2026. In Secure FMC expert mode, Cisco recommends checking /var/log/messages for license-processing activity:

cat /var/log/messages | grep license

The vendor says output containing /var/tmp/license.tmp in a command similar to the following may indicate exploitation:

www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

This is a vendor-published triage pivot, not a complete detection rule. Its absence does not establish that a device is clean, and the public advisory does not provide source IP addresses, account names, request paths, payload hashes, or a complete post-exploitation sequence.

Preserve the original logs and device state before cleanup. If the indicator is present or exploitation is otherwise suspected, contact Cisco TAC for recovery assistance. At minimum, Cisco recommends rotating all user credentials, keys, and certificates on the Secure FMC device because exploitation has been ongoing.

Fixed software

Cisco provides these branch-specific hot fixes through its Software Center:

Secure FMC release Hot fix
7.0 Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2 Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4 Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6 Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7 Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0 Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

There is no workaround. Restricting the management interface to dedicated administrative networks and explicit trusted sources reduces exposure while patching, but it does not remediate the static credential. Verify the exact installed build and successful hot-fix application rather than relying only on a deployment job's status.

Defender actions

  1. Inventory every FMC instance. Include production, lab, disaster-recovery, migration, and dormant appliances, and identify any direct or indirect internet path to the management interface.
  2. Remove public reachability. Permit management access only from dedicated administrative networks or tightly controlled jump hosts. Treat this as immediate exposure reduction, not a substitute for the hot fix.
  3. Preserve evidence. Retain /var/log/messages, authentication and web-interface logs, audit and configuration history, support bundles, process and network telemetry, and upstream firewall, proxy, VPN, and identity logs before disruptive remediation.
  4. Hunt for Cisco's pivot. Review license-processing events involving /var/tmp/license.tmp, then expand around matching timestamps for web sessions, unexpected authentication, privilege changes, configuration reads or exports, new users, command execution, file writes, and outbound connections.
  5. Apply the vendor hot fix. Use the package for the installed release family and verify the resulting state. Move unsupported branches to a supported fixed release with Cisco guidance.
  6. Treat a match as potential control-plane compromise. Isolate the manager, engage Cisco TAC, validate firewall policy and object integrity, and review managed-device changes and downstream administrative trust.
  7. Rotate from a clean administrative path. Replace all FMC user credentials, keys, and certificates after containment. Also rotate connected-system secrets that evidence shows were accessible; avoid exposing replacement material to a still-compromised appliance.
  8. Do not over-attribute. Neither Cisco nor CISA publicly names an actor, campaign, or ransomware operation in the initial disclosure.

Sources