On July 29, 2026, Cisco announced that a high‑severity static credential flaw in its Secure Firewall Management Center (FMC) is being actively exploited in zero‑day attacks. The company says an unauthenticated remote attacker can use built‑in low‑privilege credentials to log in and harvest sensitive data. That’s alarming.
Key Takeaways
- Static credential vulnerability (CVE‑2026‑20316) has a CVSS score of 5.3 but is rated High by Cisco.
- Active exploitation was confirmed in July 2026; attacks continue undisclosed.
- Hot fixes are available for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.
- Indicator of compromise: log entries referencing
/var/tmp/license.tmp. - Separate critical bypass (CVE‑2026‑20079) remains unexploited, but both share the same fix.
Historical Context
Static‑credential bugs have haunted network‑security vendors for years. Cisco’s own advisory archives show a pattern of hard‑coded accounts surfacing in management software, often after third‑party researchers flag them. In 2024, a similar issue surfaced in a different Cisco appliance, prompting a rapid patch cycle. That episode taught many customers to keep firmware current, yet the habit never fully took hold across all on‑premise deployments.
The July 2026 disclosure fits that lineage. It follows a March 2026 announcement about a separate authentication bypass (CVE‑2026‑20079). Both advisories landed within months of each other, underscoring a concentrated period of scrutiny on Cisco’s FMC code base. The timing suggests that threat‑intel teams were actively probing the same product line, likely because FMC sits at the heart of many enterprise security architectures.
When static credentials leak, the impact spreads fast. Attackers can script automated scans, log in without needing to guess passwords, and then move laterally. The 2026 episode proved that theory in practice: a zero‑day campaign began the moment the advisory went public.
Cisco FMC static credential flaw exploited
The flaw stems from a static credential embedded in the low‑privilege “www” account of Cisco Secure FMC software. Cisco says an attacker doesn’t need prior access; the credentials let them log in remotely and pull data the account can see. It doesn’t matter how the device is configured—every on‑premise Secure FMC installation is vulnerable.
While the CVSS base score sits at 5.3, Cisco bumped the severity to High because the access can be chained with other, undisclosed FMC bugs to elevate privileges. The company hasn’t revealed what those other bugs are, and it hasn’t said how attackers are using them. That omission feels unsettling.
Understanding CVE‑2026‑20316 and its impact
CVE‑2026‑20316 targets the static credentials that ship with the FMC software. Because the credentials are hard‑coded, they’re the same across all installations of the affected releases. That uniformity makes the flaw especially attractive to threat actors hunting for quick footholds.
The vulnerability affects Secure FMC Software regardless of device configuration, but it spares Cloud‑Delivered FMC, Firewall Device Manager, Secure Firewall ASA, Secure Firewall Threat Defense, and Security Cloud Control. In other words, on‑premise customers are the ones who need to act fast.
Jimi Sebree of Horizon3.ai reported the issue to Cisco, prompting the July 2026 advisory. Sebree’s involvement is the only named source we have; the report doesn’t name any specific attacker group or victim organization.
Why the CVSS score seems low
CVSS focuses on technical severity, not on business impact. A score of 5.3 suggests a moderate exploit, yet Cisco’s High rating reflects the potential for privilege escalation when combined with other vulnerabilities. That dual‑rating approach is why Cisco warned customers to treat this as a critical issue.
Indicator of compromise and detection steps
Admins should comb through /var/log/messages for suspicious entries. Cisco recommends running:
cat /var/log/messages | grep license
If you see a line like:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
that log entry flags a possible compromise. The line shows the web process (running under the www account) invoking package_info.pl as root and feeding it the /var/tmp/license.tmp file. That behavior matches the IOC Cisco published.
When the IOC appears, rotate every credential, key, and certificate on the affected FMC. The breach isn’t a one‑off; it’s ongoing, according to Cisco’s advisory.
Practical log‑review checklist
- Search for “/var/tmp/license.tmp” in
/var/log/messages. - Correlate timestamps with known attack windows (July 2026 onward).
- Validate that the www user isn’t executing unexpected scripts.
- Escalate any findings to Cisco TAC for assistance.
Patch rollout and remediation guidance
Cisco has already shipped hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds that fully mitigate the flaw, so Cisco urges customers to apply the patches immediately.
Applying the fix is straightforward if you follow Cisco’s standard upgrade path. But many organizations run older FMC versions that aren’t listed; those systems remain exposed until they upgrade to a supported release.
Because the attack surface shrinks when the FMC management interface isn’t exposed to the public internet, administrators should also consider restricting inbound access to trusted IPs only. That step won’t stop a credential‑based attack if the attacker already has network reach, but it does add a layer of defense.
Related critical authentication bypass (CVE‑2026‑20079)
In March 2026, Cisco disclosed a separate authentication bypass bug (CVE‑2026‑20079) that lets an unauthenticated remote attacker execute commands as root via crafted HTTP requests. That flaw carries a maximum CVSS score of 10.0, the highest possible rating.
Unlike CVE‑2026‑20316, the bypass doesn’t rely on static credentials. It exploits an improper system process created at boot. Cisco updated the advisory on July 29, 2026, adding a second bug ID, hot‑fix information, and the same /var/tmp/license.tmp indicator.
Cisco says it isn’t aware of any malicious exploitation of CVE‑2026‑20079 yet. However, the shared indicator raises the question of whether the two vulnerabilities are linked in the wild. Cisco hasn’t clarified that connection.
Both CVEs share the same hot‑fix releases, meaning the patches address both issues simultaneously. That simplifies remediation: one upgrade covers both flaws.
What This Means For You
If you run an on‑premise Cisco Secure FMC, you need to verify your version immediately. Check the release number; if you’re on 7.0, 7.2, 7.4, 7.6, 7.7, or 10.0, download and install the hot fix from Cisco’s portal today. Delay isn’t an option when attackers already have a foothold.
Beyond patching, rotate every credential, key, and certificate on the affected device. Then scan your logs for the /var/tmp/license.tmp IOC. If you find it, treat the system as compromised and engage Cisco TAC for forensic assistance. Ignoring the signs would be a mistake.
Looking ahead, the episode underscores why relying on static credentials is risky. Developers building network‑management tools should favor dynamic, short‑lived secrets and enforce strict access controls. The industry can’t afford another surprise that hinges on hard‑coded passwords.
As organizations continue to adopt hybrid and on‑premise firewalls, the pressure to secure management interfaces will only grow. Cisco’s swift advisory shows the stakes are real, but the response also highlights a broader need for proactive credential hygiene.
Concrete scenarios for different roles
- Startup founder: Your team runs a single FMC appliance to protect a modest data center. The device runs version 7.4, which is on the vulnerable list. A quick check of the release notes, followed by the hot‑fix download, can be done in under an hour. Skipping this step could expose customer data to an attacker who already knows the static account.
- Managed service provider: You oversee dozens of FMC instances across multiple client sites. Centralized patch management tools let you roll out the same upgrade to all appliances at once. After the upgrade, automate a script that searches each device’s
/var/log/messagesfor the license IOC, ensuring no lingering compromise. - Enterprise security engineer: Your organization runs a mixed fleet of on‑prem and cloud‑delivered firewalls. The on‑prem FMC nodes are the only ones at risk. Create a network‑segmentation rule that blocks any inbound traffic to the FMC UI from the internet, then schedule a maintenance window to apply the hot fix across the entire fleet.
Key Questions Remaining
Even with patches applied, several uncertainties linger. First, the exact nature of the undisclosed bugs that could be chained with CVE‑2026‑20316 remains unknown. Attackers may already be exploiting that chain in ways Cisco hasn’t revealed. Second, while Cisco reports no active exploitation of CVE‑2026‑20079, the shared indicator suggests the two flaws could be used together. Finally, the advisory does not specify whether any data exfiltration has occurred, leaving organizations to wonder about potential breach scope.
Answers will likely emerge as more threat‑intel reports surface. In the meantime, continuous monitoring, rapid patch deployment, and strict credential rotation remain the most effective defenses.
For the full advisory and download links, see the original report.
Sources: BleepingComputer, Cisco Security Advisory
