Cisco FMC Static Credential Flaw Lands in KEV After Active Exploitation

Cisco has released hot fixes for CVE-2026-20316, a static credential vulnerability in Cisco Secure Firewall Management Center (FMC) that has already been exploited in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 29, making this more than a routine patch bulletin.

The bug is not technically dramatic in the way a full unauthenticated RCE chain is dramatic. Cisco rates it CVSS 5.3, because successful exploitation lets a remote unauthenticated attacker log in with a low-privileged account and access sensitive data. But Cisco still assigned the advisory a High Security Impact Rating because that foothold can be chained with other Secure FMC vulnerabilities to elevate privileges.

That distinction matters. Security teams should not triage this only by the base CVSS number. FMC is a firewall management plane. Even low-privileged access to that layer can expose operational details attackers can use to map defenses, prepare follow-on exploitation, or support a broader intrusion.

What Cisco disclosed

Cisco published the advisory on July 29, 2026. The company says CVE-2026-20316 affects Cisco Secure FMC Software, regardless of device configuration. The affected product is the on-premises FMC platform used to centrally manage Cisco Secure Firewall deployments.

The vulnerability exists because of static user credentials for a low-privileged account. An attacker can use those credentials to log in to an affected FMC system without first obtaining valid organization-issued credentials.

Cisco says a successful attack can allow access to sensitive data as that low-privileged user. The company also notes that the attack surface is reduced when the FMC management interface is not reachable from the public internet.

Products Cisco lists as not affected include:

• Cloud-Delivered FMC,
• Firewall Device Manager,
• Secure Firewall ASA Software,
• Secure Firewall Threat Defense Software,
• Security Cloud Control, formerly Defense Orchestrator.

Cisco has released hot fixes for Secure FMC software releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds that fully address the vulnerability.

Why a medium CVSS can still be urgent

The CVSS vector for CVE-2026-20316 describes a network-reachable, low-complexity issue requiring no privileges and no user interaction, with limited confidentiality impact. That explains the 5.3 base score.

But the operational risk is shaped by where FMC sits. A firewall manager is not an ordinary application server. It holds policy context, device relationships, management workflows, deployment history, and clues about how traffic is segmented and controlled. It may also point attackers toward other administrative interfaces worth targeting.

Cisco explicitly says the vulnerability can be used with other Secure FMC flaws to elevate privileges. That is the important defender reading: the static credential may be the door handle, not the final objective.

In a real intrusion, attackers rarely stop after getting low-privileged access. They look for configuration files, tokens, scripts, logs, session data, API behavior, overlooked administrative paths, and evidence of other vulnerable components. When the device is a security management system, even read-level context can help them understand what they are up against.

What CISA's KEV listing changes

CISA's Known Exploited Vulnerabilities catalog is reserved for flaws with evidence of exploitation. Once a vulnerability appears there, defenders should treat it as active operational risk, not theoretical exposure.

For U.S. federal civilian executive branch agencies, KEV entries create mandatory remediation timelines under Binding Operational Directive 22-01. For everyone else, the catalog is still a useful prioritization signal. It says attackers are not merely capable of using the flaw; exploitation has been observed.

SecurityWeek reported that CISA instructed federal organizations to address CVE-2026-20316 by August 1, 2026. That short window fits the nature of the affected system. If an FMC interface is externally reachable, or broadly reachable from a corporate VPN, the patch should move quickly.

Indicators defenders should check

Cisco published a specific indicator that may show exploitation. Administrators should use expert mode and search /var/log/messages for license-related entries. Cisco's advisory points to this command:

cat /var/log/messages | grep license

If the output includes /var/tmp/license.tmp, Cisco says the vulnerability may have been exploited on the Secure FMC device.

That check should be treated as a starting point, not a complete investigation. If exploitation is suspected, Cisco recommends contacting Cisco TAC for recovery help and rotating all user credentials, keys, and certificates on the affected FMC device.

That rotation guidance is important. Static credential access may expose enough information to make existing secrets untrustworthy, especially if the attacker had time to inspect configuration, logs, stored data, or integrations.

Practical response plan

1. Identify exposed FMC instances

Start by inventorying every Cisco Secure FMC deployment. Include production appliances, lab systems, migration environments, disaster recovery systems, and appliances reachable only from VPN or internal management networks.

For each system, record:

• FMC software release,
• management interface exposure,
• internet reachability,
• VPN or jump-host access paths,
• administrative users,
• integrated firewall devices,
• backup status,
• credential and certificate dependencies.

The goal is to find the management planes before attackers do.

2. Apply Cisco's hot fix

Cisco says there are no workarounds, so remediation means applying the appropriate hot fix or upgrading to a fixed software release. The advisory lists hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.

Use Cisco's Software Checker or the advisory's fixed software section to confirm the correct release path. Firewall management infrastructure is sensitive, so validate maintenance windows, backups, and rollback plans before touching production systems.

3. Restrict management access

If the FMC management interface is publicly reachable, reduce exposure immediately. Place management access behind trusted networks, VPN, jump hosts, or other strong access control layers.

This does not replace the hot fix. It reduces the number of attackers who can reach the vulnerable surface while the patch is being planned and deployed.

4. Hunt for exploitation

Check for Cisco's /var/tmp/license.tmp indicator, then broaden the review if the device was exposed or high value.

Useful follow-up checks include:

• unfamiliar logins,
• unexpected low-privileged account activity,
• unusual administrative sessions,
• changed policy objects,
• altered device registrations,
• unexplained configuration exports,
• suspicious file creation under temporary directories,
• outbound connections from the FMC appliance,
• authentication attempts from unfamiliar IP ranges.

If there is any sign of compromise, move from patching into incident response. Preserve logs, rotate secrets, review connected firewall devices, and validate that security policy was not modified.

5. Rotate sensitive material where warranted

Cisco recommends rotating all user credentials, keys, and certificates on the device if exploitation is suspected. That is not busywork. A management appliance can carry trust material that affects more than one firewall.

Prioritize credentials used for:

• FMC administrators,
• device management,
• API integrations,
• backup jobs,
• monitoring tools,
• directory services,
• certificates and trust anchors.

The more exposed the FMC was before patching, the stronger the case for rotation.

Strategic takeaway

CVE-2026-20316 is a reminder that "low privilege" does not always mean "low urgency." On a normal business application, low-privileged access may be contained. On a security management plane, it can be the beginning of an attacker's map.

The defender priority is clear:

• patch Secure FMC using Cisco's release-specific hot fix,
• remove public exposure from management interfaces,
• check Cisco's published indicator,
• rotate credentials, keys, and certificates if exploitation is suspected,
• review connected firewalls and policies for unauthorized changes.

The risk is not just what the static credential reveals by itself. It is what attackers can do next once they have authenticated access to a system that manages network security controls.

What is CVE-2026-20316?

CVE-2026-20316 is a static credential vulnerability in Cisco Secure Firewall Management Center Software. It can let a remote unauthenticated attacker log in as a low-privileged account and access sensitive data.

Is it being exploited?

Yes. Cisco says its PSIRT became aware of active exploitation in July 2026, and CISA added the vulnerability to the KEV catalog on July 29, 2026.

Is there a workaround?

Cisco says there are no workarounds that address the vulnerability. Customers should apply the relevant hot fix or upgrade to a fixed software release.

Which products are not affected?

Cisco says Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, and Security Cloud Control are not affected.

What indicator should defenders check?

Cisco says /var/tmp/license.tmp appearing in license-related /var/log/messages output may indicate exploitation. If exploitation is suspected, Cisco recommends contacting TAC and rotating credentials, keys, and certificates.

References

1. Cisco Secure Firewall Management Center Software Static Credential Vulnerability
2. CISA Adds One Known Exploited Vulnerability to Catalog
3. Cisco Secure FMC Zero-Day Exploited in the Wild
4. Cisco warns of FMC static credential flaw exploited in zero-day attacks