Cisco's firewall brain ships a hard-coded password: CVE-2026-20316 is the 5.3 that landed on CISA's KEV list
A static low-privilege credential in Secure Firewall Management Center scored "Medium" — then got exploited in the wild. Cisco overrode the number to High. Here's why the CVSS is the wrong thing to trust.
Cisco Secure Firewall Management Center (FMC) is not a firewall. It is the control plane — the console that pushes policy, rules and software to every Firepower Threat Defense (FTD) box in your estate. So when Cisco disclosed that FMC ships with a static, hard-coded credential a remote attacker can log in with, the interesting part was not the flaw. It was the score: CVSS 5.3, 'Medium' — a number that landed the very same week on CISA's Known Exploited Vulnerabilities catalog.
Scores as of 2026-08-03live record →
What the flaw actually is
The root cause is CWE-259 — Use of a Hard-coded Password. FMC's web interface contains a built-in, low-privileged account with static credentials. An unauthenticated, remote attacker can simply log in with it and read sensitive data as that low-privileged user. No phishing, no memory corruption, no exploit chain to get in the door — the door has a key taped to it.
| Property | Value |
|---|---|
| Weakness | CWE-259 — Use of Hard-coded Password |
| CVSS 3.1 vector | AV:N / AC:L / PR:N / UI:N / S:U / C:L / I:N / A:N |
| Base score | 5.3 (Medium) |
| Privileges required | None (the credential is built in) |
| User interaction | None |
| Modeled impact | Confidentiality: Low. Integrity/Availability: None |
| Vendor workaround | None |
| Reported by | Jimi Sebree, Horizon3.ai |
Why the number lies: it is a stepping stone
Cisco did something unusual here: it assigned the advisory a Security Impact Rating of High rather than Medium, and said so in writing. The stated reason — this vulnerability "can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges." A guaranteed, unauthenticated foothold as a real (if low-priv) user is the perfect first link in a chain.
The score vs. the reality
| What CVSS 5.3 models | What an operator actually faces | |
|---|---|---|
| Impact | Confidentiality: Low — read some data | A stable foothold to chain toward root |
| Scope | Unchanged (S:U) | FMC → every managed FTD firewall |
| Severity | 5.3 Medium | Cisco SIR: High · CISA: KEV |
| Exploitability | Theoretical at scoring time | Active exploitation observed, July 2026 |
Foothold to fleet: how a 'Medium' becomes a breach
- Internet-reachable FMC web UI
- Log in with the hard-coded low-priv account (CVE-2026-20316)
- Read sensitive data as that user
- Chain a second FMC flaw
- Escalate to root on FMC
- Push attacker policy to the managed FTD fleet
Who is affected
Cisco states the flaw affects Secure FMC Software regardless of device configuration — the static credential is present, full stop. That spans the supported release trains from 7.0 through 7.7 and into 10.0. Crucially, several adjacent products are not affected.
| Affected FMC train | Fixed hotfix |
|---|---|
| 7.0 | Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3 |
| 7.2 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4 |
| 7.4 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3 |
| 7.6 | Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2 |
| 7.7 | Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2 |
| 10.0 | Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2 |
Timeline
Disclosure and exploitation
- Cisco PSIRT becomes aware of active exploitationExploitation observed in the wild before the fix was broadly deployed.
- Advisory published
cisco-sa-fmc-static-cred-BET3Cjh, reported by Jimi Sebree of Horizon3.ai. SIR set to High. - Added to CISA KEVFederal remediation obligation; a clear 'stop and patch' signal for everyone else.
- Advisory updated to v1.3 (Final)Fixed hotfixes and indicator guidance finalized.
Hunt for it, then patch it
Because exploitation is already happening, treat an exposed FMC as compromised until proven otherwise. Cisco's advisory publishes an indicator check you can run in FMC expert mode — the tell is a sudo entry for the low-privileged web account escalating, and a dropped file under /var/tmp/.
# Indicator strings referenced in Cisco's advisory:
# a sudo log line for the low-priv web account running as root
www : PWD=/ ; USER=root ...
# and a dropped artifact under /var/tmp
/var/tmp/license.tmp
# Run Cisco's documented zgrep check in FMC expert mode.
# If either indicator is present, contact Cisco TAC immediately.- Apply the fixed hotfix for your FMC train (table above). There is no workaround — patching is the only fix.
- Take the FMC management interface off the public internet. Cisco explicitly notes that if the management interface has no public internet access, the attack surface is reduced.
- Run Cisco's indicator check in expert mode and hunt for the
/var/tmp/license.tmpartifact and anomalouswwwsudo activity. - If indicators are present, engage Cisco TAC and treat it as a potential chain — review FMC audit logs and any policy pushed to managed FTD devices.
- Rotate credentials and review administrative sessions on FMC and downstream firewalls.
CVE data and advisory status as of 2026-08-03live record →