Cisco baked a password into your firewall manager: CVE-2026-20316

A firewall is supposed to be the thing that keeps attackers out. So it is an uncomfortable week when the box that manages your firewalls ships with a password baked into the software. That is CVE-2026-20316: a hard-coded credential in the web interface of Cisco Secure Firewall Management Center (FMC), letting an unauthenticated attacker log straight in. It is already being exploited in the wild, CISA added it to the Known Exploited Vulnerabilities catalog on 29 July 2026, and the federal fix-by date is 1 August 2026.

What the flaw actually is

The bug is textbook CWE-259 (use of a hard-coded password). Cisco Secure FMC ships with static credentials for a built-in, low-privileged account that is reachable through the appliance's management web interface. Because the credential is embedded in the software and identical across installs, a remote attacker needs no prior access - they simply authenticate to the FMC login page as that account and read whatever it can see. In Cisco's words, an attacker "could exploit this vulnerability by using the account to log in to an affected system" (Cisco advisory).

There is no memory corruption and no exploit script involved for that first step - the exploit is the login. That makes it trivial and effectively 100% reliable once two things are true: the management interface is reachable, and the attacker knows the credential. As of this writing the actual username and password have not been published in the advisory or any public write-up, which is the main reason turnkey mass-exploitation is not yet circulating even though the bug class is dead simple (BleepingComputer).

Why a "Medium" 5.3 is really an emergency

Read the score carefully before you deprioritise this one. The CVSS 3.1 base is 5.3 (Medium), vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (Tenable). Every metric on the access side is maxed - network, low complexity, no privileges, no user interaction - but the impact side is deliberately small: confidentiality Low, integrity and availability None. CVSS is scoring exactly one thing: an unauthenticated party can read some low-privilege data.

Cisco overrode its own math and assigned a Security Impact Rating of High, for one stated reason: the access "can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco advisory, SecurityWeek). CVSS base scores intentionally do not model chaining; the SIR does. And an FMC is not an ordinary web app - it is the management brain for a fleet of firewalls, holding policy, configuration and credentials for every device it controls. A low-privilege foothold there is the first hop, not the finish line. If your triage queue filters on "Medium/5.3", this KEV-listed, actively-exploited edge-security bug is exactly the kind of thing it will wrongly drop.

Am I affected?

Build strings are taken from the advisory's hotfix filenames; treat the exact numbers as advisory-sourced and confirm against your own Cisco download portal. Check your version in the FMC UI (Help > About) or CLI (show version) (Cisco advisory, runZero).

The exploitation chain

Here is how a "read-only" login becomes a firewall control-plane problem. The static-credential login gives an attacker an authenticated foothold; from there, Cisco says the access can be paired with other FMC flaws to elevate privileges. The advisory does not name which - but the most plausible partner is CVE-2026-20079, a critical FMC authentication-bypass / root code-execution flaw, with CVE-2026-20131 (an FMC deserialization RCE already abused by the Interlock ransomware crew earlier in 2026) as a second candidate. Both the chained-companion pairing and the exact timeline are inferred from third-party reporting, not stated by Cisco, so treat the chain as a hedged model - but note the observed www -> root activity is consistent with it (Help Net Security, SecurityWeek).

Timeline

Are you exposed? Are you compromised?

Two questions decide your risk: does an FMC run an unpatched train, and can any of them be reached from an untrusted network. For the second, enumerate every FMC's HTTPS admin interface and confirm from the outside-in that none are internet-reachable - an exposed FMC login page is the single condition that turns this from "Medium" into "patch tonight" (runZero).

For compromise, Cisco published one high-fidelity host indicator. From the FMC expert-mode CLI, check the system log for the web account escalating to root against a temp file:

cat /var/log/messages | grep license# indicator of compromise:# www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp

To hunt the login side, forward the FMC audit log to your SIEM (System > Configuration > Audit Log > Send Audit Log to Syslog) and watch for web-UI logins from unexpected source IPs. Cisco did not disclose the static account's username, so you cannot match on it - pivot on source-IP anomaly and correlate with the host indicator above. Here is the deployable Sigma rule for the host IoC:

title: Cisco Secure FMC Static-Credential Exploitation IoC (CVE-2026-20316)
id: 8b3f0c4e-2d71-4a19-9c6b-fmc20316ioc1
status: experimental
description: FMC web account (www) invoking package_info.pl as root against /var/tmp/license.tmp.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
author: cve.tools
date: 2026/07/31
tags:
  - attack.initial_access
  - attack.t1078.001
logsource:
  product: linux
  service: syslog   # FMC expert-mode /var/log/messages
detection:
  ioc_tempfile:
    - '/var/tmp/license.tmp'
  ioc_script:
    - 'package_info.pl'
  condition: ioc_tempfile and ioc_script
falsepositives:
  - Baseline your FMC first; legitimate licensing routines are not expected to reference this path.
level: high

Fix it

1. Patch now. Install the per-train hotfix (or a later fixed release) - 7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.5.1, 7.7.12.1 or 10.0.1.1. There is no workaround; only the patch removes the credential.
2. Isolate the management plane. Put the FMC admin interface behind a management VLAN, ACLs, a jump host or VPN, and never expose the admin port to the internet. This reduces - it does not remove - the risk, so patch anyway.
3. Assume-breach if it was exposed. Because exploitation is ongoing, Cisco recommends rotating all user credentials, keys and certificates on the FMC. If the host indicator is present, rotate every secret the FMC could reach and engage Cisco TAC - treat it as a potential control-plane breach, not a single-host incident.

Sources

• Cisco Security Advisory cisco-sa-fmc-static-cred-BET3Cjh
• CISA Known Exploited Vulnerabilities catalog
• BleepingComputer - Cisco warns of FMC static credential flaw exploited in zero-day attacks
• SecurityWeek - Cisco Secure FMC zero-day exploited in the wild
• The Hacker News - Cisco FMC zero-day actively exploited
• Help Net Security - Cisco FMC CVE-2026-20316 exploited
• Security Affairs - CISA adds Cisco Secure FMC flaw to KEV
• Tenable - CVE-2026-20316
• runZero - Cisco Secure FMC exposure guidance