Cisco FMC Hardcoded Password CVE-2026-20316 Under Active Attack

On July 29, 2026, Cisco disclosed CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC). A password baked into the product itself is still there, and anyone who knows it can log in. In the advisory Cisco writes that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."

The same day, the US cybersecurity agency CISA added it to its catalog of vulnerabilities under active attack and gave federal agencies until August 1 to act. Three days from listing to deadline. There is no workaround; the only option is to apply the fix.

First, work out whether this is even your problem

Only the on-premises flavour of FMC is affected. Cisco's product names run close together, so start by separating them.

FMC is the console that configures and monitors all the Cisco firewalls in an organisation from one place. It is not a firewall; it is the thing that commands them. Cisco's own datasheet calls it "your administrative nerve center for managing critical Cisco network security solutions."

The fix does not arrive as a normal version upgrade. It ships as a hotfix, and you need the one matching your train.

The version ranges recorded in NVD include the 7.3 train (7.3.0 through 7.3.1.2), but Cisco's hotfix table lists nothing for 7.3. If you are on 7.3, ask Cisco support directly.

Who wants a hole like this

A firewall management console is prime quarry for attackers who want to stay inside a corporate network for a long time. State-backed espionage crews and ransomware operators both look at the same box. There are other ways in if you only want to steal and leave, but owning the firewall's command post puts you on the side that decides what traffic is allowed.

A hardcoded password is how they get their foot in the door. Log in through the front with a low-privilege account, then use that foothold to chain into another flaw and climb to administrator. Cisco itself explains that it rated this flaw above its numeric score because it "can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges." Small on its own, excellent as a component.

What you lose when the console falls is not one firewall's worth. Rewrite the configuration to let specific traffic through and the way in is open. Wipe the logs and nobody can reconstruct what happened. A different flaw Cisco disclosed in the same product in March 2026 turned out to have been used as a zero-day by a ransomware crew for 36 days before anyone knew, as recorded in CISA's catalog of actively exploited flaws. The machines that do the defending have become the first thing attacked.

What is actually going on

CVE-2026-20316: a password left inside the product

The classification is CWE-259, use of a hard-coded password. An account and password planted during development are still present in the shipped software. Customers cannot change them, and the same string works on every deployment of that product worldwide.

Per Cisco, an unauthenticated remote attacker could log in to the FMC web interface using a low-privileged account. What that account can read is sensitive data; it is not takeover on its own. As noted, its value is as a stepping stone into other flaws.

It was reported by Jimi Sebree of Horizon3.ai. Cisco's internal bug ID is CSCwt95997, and the advisory went out at 16:00 GMT on July 29. No workarounds are available.

CVE-2026-20079: the 10.0-rated companion, updated the same day

Within five minutes of publishing CVE-2026-20316, Cisco pushed version 2.0 of its existing advisory for CVE-2026-20079, an authentication bypass rated at the maximum 10.0. What the revision added was indicators of compromise (below) and hotfixes.

Cisco has not said whether the two were chained together in the observed attacks. What is on the record is the five-minute gap and the fact that the revised advisory gained forensic indicators that read like they came from a real incident.

CVE-2026-20131: the March 2026 case, exploited 36 days ahead of disclosure

The same product was listed by CISA once already, on March 19, 2026. That one is rated 10.0 and lets an attacker seize top-level privileges just by sending data to the management interface. In CISA's catalog it is the entry flagged "Known" for ransomware campaign use. CVE-2026-20316 is flagged "Unknown." Some articles conflate the two, so check the number.

Scored 5.3, rated High, and due in three days

The confusing part of this case is that the ratings do not agree. Laid out, they look like this.

CVSS measures the technical severity of a flaw taken on its own. Here it was graded as low impact on confidentiality with no impact on integrity or availability, which produces 5.3. On the number alone, nothing looks urgent.

Cisco then put a sentence in the advisory that explicitly overrides that number: "Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges." The vendor is telling you not to trust the score.

CISA's three-day window is unusually tight too. Under BOD 26-04, issued in June 2026, deadlines are no longer uniform; they are set by tiering risk on factors such as internet exposure and how easily the attack automates. Three days means top tier. And CVE-2026-20316 was the only entry added on July 29.

You can see everything currently listed as under active attack through our searchable KEV dashboard. The July 29 catalog holds 1,656 entries.

That password had been public for four months

The timeline is the part that snags.

Cale Black of VulnCheck published an analysis of CVE-2026-20079 on March 26, 2026 that names the embedded credentials outright. The post says:

The same post reproduces the source line responsible: change_password("report", "snortrules"). Several other pairs, such as csm_processes:csmdaemon, are listed alongside it.

So the "static credentials" Cisco carved out as CVE-2026-20316 on July 29 had been sitting in plain text on a technical blog for four months. Search for exploit code and you will find none; a GitHub repository search for the CVE returns zero results. But this flaw does not need exploit code. If you know the username and password, you type them into a login form.

Published March 26, exploitation detected in July, CVE assigned July 29. Cisco has not explained what those four months were.

How to check whether you have already been hit

With exploitation confirmed, patching is not where this ends. Cisco's advisory includes a procedure for checking indicators of compromise.

From FMC expert mode, run cat /var/log/messages | grep license and look for any line containing /var/tmp/license.tmp. The example Cisco gives is:

That is the web server's user running the license-processing binary as root. It does not normally appear. If you find it, Cisco tells you to contact TAC and rotate every credential, key and certificate. A patch does not un-steal what has already been taken.

According to the VulnCheck analysis mentioned above, the attack chain runs: fix a session using a static identifier, escalate through the report account, pull the token needed from the interface, write a file to /var/tmp/license.tmp, and get it executed as root. The location Cisco tells you to look at is exactly that last step.

Only a few hundred are exposed, but each one carries more weight

VulnCheck's survey (as of March 26, 2026) put the number of FMC management interfaces reachable from the internet at roughly 300 on Censys and 600 to 700 on FOFA. Nearly a factor of two between services under the same criteria, so "a few hundred" is the honest range.

That sounds small. But one FMC fronts many firewalls: per Cisco's datasheet, the physical FMC 4700 manages up to 1,000 devices. Three hundred consoles can sit in front of tens of thousands of boxes. A small device count does not translate into a small impact.

Two caveats. This counts interfaces reachable from outside, not unpatched systems. And it rests on a single VulnCheck post with no independent corroboration; nobody has re-measured since the July listing.

Also, the "nearly 48,000 devices" figure you will run into in search results is ASA/FTD firewalls, not FMC, and belongs to a separate September 2025 incident. No public data on FMC deployment counts in Japan could be found.

None of this changes what to do. Keep the management interface off the public internet. Cisco says as much in the NVD description: "If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced." An attacker already inside your network can still use it, so apply the hotfix either way.

Coverage so far is remarkably thin

As of July 30, the only Japanese-language report is a single Security NEXT article, carrying the essentials: CVSS 5.3, Cisco's rating of High (second of four), exploitation known as of July 2026, and CISA's August 1 deadline.

Nothing on this appears in JPCERT/CC advisories or its Weekly Report, in IPA's security bulletins, or in JVN as of July 30. The July 29 Weekly Report covers July 19 to 25, so a later issue may pick it up. In English, BleepingComputer's story is essentially the only coverage.

It is also worth being precise that the only party claiming to have observed exploitation is Cisco's own PSIRT. When it started, who is behind it, which organisations were targeted, how many incidents: none of it has been published. Talos, Cisco's own threat research arm, has published nothing on this either, which stands out given the detailed reports it produced for the 2024 campaign against ASA and FTD.

The actions are simple. If you run self-hosted FMC, apply the hotfix for your train. Confirm the management interface is not reachable from the internet. Grep the logs for /var/tmp/license.tmp. Do those three things by August 1. The deadline is aimed at federal agencies, but with exploitation in progress there is no reason for anyone else to wait.

Sources

• ▸ Cisco Security Advisory - Cisco Secure Firewall Management Center Software Static Credential Vulnerability (cisco-sa-fmc-static-cred-BET3Cjh) (July 29, 2026)
• ▸ NVD - CVE-2026-20316
• ▸ CISA - Known Exploited Vulnerabilities Catalog (July 29, 2026 edition, 1,656 entries)
• ▸ CISA - BOD 26-04: Prioritizing Security Updates Based on Risk
• ▸ VulnCheck - Cisco FMC Auth Bypass (CVE-2026-20079) (March 26, 2026, Cale Black)
• ▸ BleepingComputer - Cisco warns of FMC static credential flaw exploited in zero-day attacks (July 29, 2026)
• ▸ Security NEXT - Vulnerability in firewall management product Cisco FMC, already exploited (July 30, 2026)
• ▸ Cisco - Secure Firewall Management Center datasheet