Cisco has confirmed active exploitation of CVE-2026-20316, a vulnerability in Secure Firewall Management Center Software caused by hard-coded static credentials for a low-privilege account. The disclosure, published July 29, 2026, with inclusion in CISA's KEV catalog, forced the federal agency to set a remediation deadline of August 1, 2026, for FCEB agencies. No complete workarounds exist: the only mitigation is applying the hotfixes released for six product versions.
- CVE-2026-20316 has a CVSS 5.3 but Cisco assigned a Security Impact Rating of High due to chaining potential with other FMC vulnerabilities
- Static credentials allow unauthenticated remote access to a low-privilege account in the product's web interface
- CISA added the vulnerability to the KEV catalog on July 29, 2026, with BOD 26-04 deadline set for August 1, 2026
- Documented indicator of compromise: presence of the file
/var/tmp/license.tmpin system logs, executed viapackage_info.plwith root privileges
The Mechanism: How a Hard-Coded Password Opens the Management Console
The vulnerability resides in the presence of static credentials for a limited-privilege account within the web interface of Cisco Secure Firewall Management Center Software. According to the Cisco advisory cited by The Hacker News: "This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system". Unauthenticated remote access allows viewing sensitive data, with the risk of escalation should the attacker chain this access with other vulnerabilities present in the same platform.
Researcher Jimi Sebree of Horizon3.ai received credit for the discovery. His analysis highlighted how the presence of default credentials in an enterprise security product represents a systemic criticality: the firewall management console is the aggregation point for network policies, and its compromise exposes the entire defense architecture.
CVSS 5.3 vs. SIR High: When the Score Hides the Risk
The discrepancy between the CVSS 5.3 score and Cisco's High Security Impact Rating is the crux of the technical reading. CVSS calculates risk based on the attack vector in isolation: network access, low complexity, low privileges required, no user interaction. The result is a limited impact for the compromised account. Cisco, however, explained that the elevated rating stems from the chaining potential with other vulnerabilities in Secure FMC Software, a pattern that transforms low-privilege access into privilege escalation or total platform compromise.
The source does not confirm that chaining has occurred in real-world exploitation. Cisco documented the technical potential, not an observed attack chain. This distinction is relevant: federal agencies must act based on demonstrated risk (active exploitation of initial access) while chaining remains a plausible but unverified scenario.
"Cisco PSIRT became aware of active exploitation of this vulnerability this month"
— Cisco, via Help Net Security
The Timeline and the Indicator: Active Exploitation in July 2026
Cisco PSIRT became aware of active exploitation in July 2026, with the temporal reference "earlier this month" relative to disclosure. On July 29, 2026, CISA formalized the threat by adding CVE-2026-20316 to the Known Exploited Vulnerabilities catalog, activating Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.
The indicator of compromise is specific and verifiable: the presence of /var/tmp/license.tmp in system logs, executed through the command package_info.pl with root privileges. This operational detail allows organizations to perform retrospective hunting on FMC systems, even in the absence of real-time detection of the initial access phase. The dossier does not specify the full nature of post-exploitation activities observed by Cisco.
What to Do Now
- Apply the hotfixes released for versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 of Secure Firewall Management Center Software: no alternative workarounds exist \li>Perform verification of the
/var/tmp/license.tmp indicator in logs via cat /var/log/messages | grep license and contact Cisco TAC if a positive match is found\li>Rotate all user credentials, keys, and certificates on the FMC device, as recommended by Cisco in case of suspected active exploitation\li>FCEB agencies must complete remediation by August 1, 2026, for compliance with CISA BOD 26-04
CISA and the August 1 Deadline: The Signal for the Private Sector
The inclusion in the KEV catalog with a four-day remediation deadline is consistent with CISA practice when identifying vulnerabilities in security management systems with confirmed active exploitation. BOD 26-04 obligates federal civilian agencies but serves as a priority signal for the private sector, especially for critical infrastructure using FMC as a centralized management console.
The pattern is not new for the platform. Historical context documented by Help Net Security shows FMC as a recurring target, with previous campaigns such as the Interlock group's exploitation of CVE-2026-20131. The product's recidivism as an attack surface amplifies the criticality of patch management, in a context where security consoles themselves become the breaking point in the defense chain.
Frequently Asked Questions
Why can a CVSS 5.3 be considered High by Cisco?
CVSS evaluates the vulnerability in isolation. Cisco assigned SIR High because low-privilege access can chain with other FMC vulnerabilities for escalation, transforming a limited impact into total platform compromise.
Is Secure Firewall Threat Defense Software vulnerable?
No. The dossier specifies that the unaffected product is Threat Defense Software; the vulnerability exclusively affects Management Center Software.
What happens if I don't find the /var/tmp/license.tmp indicator?
The absence of the IoC does not rule out compromise: the source documents the indicator as evidence of exploitation but does not state it represents the only trace left by the attacker.
Sources
- https://www.xion.it/news/2026-07-30-cisco-fmc-zero-day-patch-urgenti/
- https://www.helpnetsecurity.com/2026/07/30/cisco-fmc-cve-2026-20316-exploited/
- https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html
- https://www.cisa.gov/news-events/alerts/2026/07/29/cisa-adds-one-known-exploited-vulnerability-catalog
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
- https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/
Information has been verified against cited sources and updated at time of publication.