Cisco FMC ships with hardcoded credentials — two zero-days exploited in the wild, one CVSS 10.0

July 29, 2026 — Cisco dropped two security advisories for Secure Firewall Management Center (FMC) on the same day. The first, CVE-2026-20316, exposes hardcoded static credentials baked into the software — already exploited as a zero-day. The second, CVE-2026-20079, carries a CVSS 10.0 score: full authentication bypass, remote code execution as root, no credentials required. The two vulnerabilities share the exact same indicator of compromise (/var/tmp/license.tmp), and Cisco isn’t saying whether they’re connected.

Here’s the bottom line. If your FMC management interface touches the internet, assume compromise. If it doesn’t, check your logs anyway — exploitation has been active since July 2026, and the attackers leave behind a single file that’s alarmingly easy to miss.

CVE-2026-20316 — the password Cisco forgot to remove

The first vulnerability is a design-level mistake. Cisco Secure FMC Software contains static credentials for a low-privilege account — a single password compiled into the binary and identical across every deployed instance worldwide.

An unauthenticated remote attacker can use these credentials to log into the affected system and access whatever data the compromised account can see. Cisco assigned CVE-2026-20316 a CVSS 5.3 score but rated it High severity — the raw number undersells the risk because the initial access can be chained with other vulnerabilities to escalate privileges.

The flaw was discovered and reported by Jimi Sebree of Horizon3.ai. Cisco acknowledges active exploitation since July 2026 but refuses to disclose when the attacks actually started, who is behind them, or which organizations were targeted. The true scope of the compromise is unknown.

All versions of Cisco Secure FMC Software are affected regardless of configuration. Cloud-based variants (Cloud-Delivered FMC, Security Cloud Control) and standalone appliances (Firewall Device Manager, Secure Firewall ASA, Secure Firewall Threat Defense) are not impacted.

CVE-2026-20079 — the 10.0 that makes the static credential look like a footnote

Originally disclosed in March 2026 and updated on July 29, CVE-2026-20079 is an authentication bypass vulnerability that lets an unauthenticated attacker execute scripts and commands as root by sending crafted HTTP requests to the FMC device.

Unlike CVE-2026-20316, this flaw requires no credentials and no prior access of any kind. The faulty system process is created at boot and remains exploitable as long as FMC is running. CVSS 10.0 — the maximum possible score — means the impact on confidentiality, integrity, and availability is total.

Cisco states it has no evidence of malicious exploitation of CVE-2026-20079, yet added the same indicator of compromise to both advisories on July 29. The coincidence is hard to ignore. BleepingComputer reached out to Cisco to clarify whether the two vulnerabilities are connected and whether the shared IOC was intentional — no response at time of publication.

A technical detail makes the picture murkier: Cisco’s description of CVE-2026-20079 explicitly states it can be exploited without using the static credentials from CVE-2026-20316 to achieve root access. Two independent paths, same destination, same target.

One IOC, two CVEs: /var/tmp/license.tmp

The indicator of compromise provided by Cisco is identical across both advisories. Administrators should search /var/log/messages for an entry where the FMC web process, running under the www account, invokes the package_info.pl script as root with the file /var/tmp/license.tmp:

# In expert mode on the FMC appliance:
grep "license.tmp" /var/log/messages

If this entry appears, Cisco recommends treating the device as compromised and taking the following actions immediately:

• Full credential rotation: all user passwords, API keys, certificates, and secrets stored on the FMC.
• Audit managed appliances: a compromised FMC may have pushed malicious configurations to the firewalls it administers.
• Contact Cisco TAC for recovery assistance.

Cisco notes that the attack surface is reduced when the FMC management interface is not exposed to the internet. “Reduced” does not mean “eliminated”: an attacker already inside the network — via an initial compromise, VPN access, or an infected workstation — can exploit these vulnerabilities from the internal network just as easily.

Hotfixes available, no workarounds

Cisco has released hotfixes for Secure FMC branches 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds that fully address the vulnerabilities. Applying the hotfixes is the only option.

The fixed build numbers are listed in security advisories cisco-sa-fmc-static-cred and cisco-sa-fmc-auth-bypass. Cisco recommends updating all instances immediately — do not wait for the next scheduled maintenance window.

For organizations that cannot apply the patches right away, the only effective mitigation is complete network isolation of the FMC management interface: place it behind a dedicated jump host, with no routing from the internet or the general user network, mandatory multi-factor authentication, and exhaustive session logging.

FMC, the blind spot in your perimeter

Cisco Secure Firewall Management Center is the central console that manages security policies, firewall rules, IPS signatures, threat intelligence updates, and event correlation for dozens — sometimes hundreds — of firewalls. It is the keystone of the organization’s network security posture.

The paradox is well-known but rarely addressed: organizations harden the firewalls that FMC manages, but leave the FMC itself with default configurations, exposed interfaces, and quarterly update cycles. A compromised FMC gives an attacker the ability to:

• Modify firewall rules to open paths into the internal network.
• Disable IPS/IDS signatures that would detect lateral movement.
• Exfiltrate security logs containing the full network topology, internal IP addresses, filtering policies, and segmentation data.
• Deploy malicious configurations to managed appliances, turning firewalls into relays or pivot points for the attacker.

The FMC architecture makes it a prime target. One appliance, the entire defense chain.

Why CVSS 5.3 is misleading

The CVSS 5.3 score for CVE-2026-20316 may create a false sense of security. Cisco itself classified it as High rather than Medium, acknowledging that the computed score does not reflect the real-world risk. The reason is straightforward: CVSS measures a vulnerability in isolation, not its chaining potential.

CVE-2026-20316 provides initial access to an account — low-privileged, yes, but inside the management zone. That initial access can be combined with:

• Undisclosed privilege escalation paths that Cisco mentions without identifying.
• CVE-2026-20079 (CVSS 10.0) if the attacker pivots from the compromised account.
• Local vulnerabilities in the Perl, Python, or shell scripts used by FMC for administrative tasks.

This is the principle of compound CVSS: a Medium flaw becomes Critical when it’s the first link in an exploit chain. Attackers don’t think in isolated scores.

What to do now

Your course of action depends on your exposure:

If your FMC is or has ever been reachable from the internet — apply the hotfixes immediately, check for the IOC in your logs, and treat the appliance as potentially compromised. Run a full audit of firewall rules deployed since July 2026 and compare them against your known configuration baseline. If the IOC is present, engage your incident response process without delay — the attacker may have pivoted to the managed firewalls.

If your FMC is only accessible from the internal network — you are not safe. Apply the patches, check the logs, and use this window to segment the management interface behind a dedicated VLAN with strict access control. A compromised workstation on the same network as FMC is all an attacker needs.

In every case — run the log check command above. The IOC is simple, the check takes 30 seconds. Don’t postpone it.

Verdict

CVE-2026-20316 is a blunt reminder that security appliances are not inherently secure. Hardcoded credentials in a firewall management product, in 2026, is a design failure the industry should have eliminated a decade ago.

The real risk isn’t the flaw itself — it’s the invisible attack surface that management interfaces represent. FMC, vCenter, iDRAC, iLO, IPMI: these consoles are the attackers’ priority target because they control everything beneath them.

If your FMC is reachable from the internet, you have a problem. If you don’t know whether it is, you have two. Check your logs, apply the hotfixes, and disconnect the management interface from the public network. Today.

References

• Cisco Security Advisory: Cisco Secure Firewall Management Center Static Credential Vulnerability (cisco-sa-fmc-static-cred) — accessed July 30, 2026
• Cisco Security Advisory: Cisco Secure Firewall Management Center Authentication Bypass Vulnerability (cisco-sa-fmc-auth-bypass) — accessed July 30, 2026
• BleepingComputer — Cisco warns of FMC static credential flaw exploited in zero-day attacks — July 29, 2026
• NVD — CVE-2026-20316 — accessed July 30, 2026
• NVD — CVE-2026-20079 — accessed July 30, 2026