Static Cisco Secure FMC Account Is Under Active Exploitation

Cisco disclosed CVE-2026-20316 on July 29, a static-credential flaw in the web interface of on-premises Secure Firewall Management Center. An unauthenticated remote user can sign in with a low-privilege account and reach sensitive data. Cisco says active exploitation is underway.

Every on-prem Secure FMC configuration is affected. Cloud-Delivered FMC, Firewall Device Manager, ASA, FTD and Security Cloud Control are outside the affected-product list for this CVE. Cisco has not disclosed the number or identity of affected customers, what data attackers obtained, or whether the static account was combined with another vulnerability.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 29 with an August 1 remediation deadline for federal agencies covered by its directive. The catalog describes the credential as a hard-coded password and lists ransomware use as unknown.

Static credentials reach every on-prem FMC configuration

CVE-2026-20316 carries a CVSS base score of 5.3 because the account has low privileges and the documented direct impact is limited to confidentiality. Cisco assigned a High security-impact rating because attackers could combine the account with other Secure FMC vulnerabilities to elevate privileges.

The flaw affects Secure FMC regardless of device configuration. Removing public internet access from the management interface reduces the remote attack surface, but it does not remove the static account or remediate the vulnerability.

Cisco released hot fixes and says no workaround addresses the flaw. The vendor also recommends rotating all user credentials, keys and certificates on any Secure FMC device where exploitation is suspected because active exploitation has been ongoing.

One license.tmp marker appears in two Cisco advisories

Cisco tells administrators to search /var/log/messages for a package-inspection command that references /var/tmp/license.tmp:

cat /var/log/messages | grep license

The example event runs /usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm as root. Cisco says this marker may indicate exploitation of CVE-2026-20316.

The same marker appears in Cisco’s separately updated advisory for CVE-2026-20079. That March vulnerability follows a different path: crafted HTTP requests abuse a process created at boot, bypass authentication and execute scripts or commands as root. Cisco says it is not aware of malicious use of CVE-2026-20079.

Figure details

The left path shows CVE-2026-20316: static credentials permit remote login to a low-privilege account, which can access sensitive data on any on-prem Secure FMC configuration. Cisco reported active exploitation in July 2026. The right path shows CVE-2026-20079: crafted HTTP requests abuse a boot-time process to bypass authentication and execute scripts or commands as root on any on-prem Secure FMC configuration. Cisco says it knows of no malicious use of that CVE. Both paths converge on the same package_info.pl command containing /var/tmp/license.tmp, so the marker supports compromise triage without identifying which vulnerability was used.

Treat the shared event as evidence that an FMC device may have been compromised, not as proof of which CVE was used. Cisco has confirmed active exploitation only for the static-credential flaw. The separate authentication bypass provides a root-level path, but Cisco says it knows of no malicious use.

One hot-fix set covers both advisory paths

Cisco lists the same hot-fix packages for both advisories across Secure FMC release trains 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Administrators should use the advisory’s current package table or Cisco Software Checker rather than infer a fixed build from the release-train number.

For each on-prem FMC:

1. Identify every on-prem Secure FMC instance and record its exact release.
2. Remove public access to the management interface where it exists. Treat this as exposure reduction while the hot fix is staged.
3. Search /var/log/messages for license.tmp and preserve the surrounding timestamps, process records and authentication evidence.
4. Apply Cisco’s listed hot fix or move to a fixed release. Cisco says there is no workaround.
5. If the marker or other evidence suggests exploitation, contact Cisco TAC and rotate all user credentials, keys and certificates on the device.
6. Verify the installed build or hot-fix package against the advisory, then rerun the log search and confirm the management interface is reachable only from approved networks.

A clean grep result does not prove that the device was untouched. Cisco publishes one indicator, and the advisory does not describe its retention window or every artifact left by exploitation. Incident scope should include access records, configuration changes, credential use and downstream systems managed by the FMC.

Treat the CVSS score as one input to the decision

The published base score captures the direct low-privilege data access. It does not encode Cisco’s report of active exploitation, the universal exposure across on-prem Secure FMC configurations, or the vendor’s warning that the account can support privilege-escalation chains.

Inventory and hot-fix every affected FMC, search for the published marker, and handle a match as compromise evidence that requires credential rotation and TAC-assisted recovery. Keep the two CVEs separate until additional evidence identifies the path.