A vulnerability in the web interface of Cisco Secure Firewall Management Center

CVE-2026-20316 is a CWE-259 (Use of Hard-coded Password) vulnerability in Cisco Secure Firewall Management Center (FMC). Every on-premises FMC installation across versions 7.0.0 through 10.0.1 ships with static credentials for a built-in low-privilege account. An unauthenticated, remote attacker who can reach the FMC web interface can log in with these credentials — no brute force, no exploitation of a logic flaw, just a username and password baked into the binary. From that foothold, Cisco confirms the attacker can access sensitive data and chain with undisclosed additional FMC vulnerabilities to escalate to root. The flaw affects all on-prem FMC deployments regardless of configuration. Cloud-Delivered FMC, Firewall Device Manager, ASA, FTD, and Security Cloud Control are not affected.

The vendor's CVSS 3.1 base score of 5.3 MEDIUM is a textbook example of the vector formula failing to capture blast radius. The CVSS models only the immediate impact of the low-privilege account (C:L/I:N/A:N), ignoring the confirmed privilege-escalation chain to root and the fleet-scale blast radius inherent in compromising a firewall management plane. Even Cisco's own Security Impact Rating breaks from the CVSS to call this High. CISA went further: KEV listing on the same day as disclosure (July 29, 2026) with a 3-day remediation deadline of August 1 — the shortest window CISA assigns. GreyNoise observed five exploitation surges in the 18 days preceding disclosure, consistent with dedicated operators running targeted campaigns. The 5.3 label is dangerously misleading for any team triaging this in a queue; this is an actively exploited zero-day in the management plane of your entire firewall fleet.

Why this verdict

• Active zero-day exploitation: Cisco confirmed active exploitation before disclosure. GreyNoise observed five pre-disclosure exploitation surges. CISA KEV-listed on day zero with a 3-day deadline — the most urgent signal the US government issues.
• Zero-friction initial access: CWE-259 hard-coded credentials eliminate all attacker skill requirements. The credentials are identical across every unpatched FMC installation worldwide. No brute force, no social engineering, no exploit development needed.
• Role multiplier: FMC is canonically a high-value-role component. It is the centralized management plane for all Cisco Firepower/FTD firewalls in an enterprise. 100% of FMC installations occupy this role by definition. A root compromise of FMC enables: policy manipulation across all managed firewalls, disabling security controls fleet-wide, traffic interception, and persistent backdoor deployment on managed sensors. Blast radius = fleet-scale. The Interlock ransomware group demonstrated this exact FMC-to-fleet playbook against CVE-2026-20131 earlier in 2026.
• Universal affected population: Every on-prem FMC release from 7.0 through 10.0 is vulnerable. No configuration is required to be exploitable. No workaround exists. This is the broadest possible affected surface for this product.
• CVSS dramatically understates risk: The 5.3 MEDIUM score captures only the low-priv account's direct data access. It does not model the confirmed privilege escalation chain, the fleet-scale blast radius, or the management-plane role of the target. Even Cisco's own SIR breaks from the CVSS to call this High.

Why not higher?

A 9.0 rather than 10.0 reflects two genuine uncertainties: the specific chaining vulnerabilities for privilege escalation have not been publicly disclosed (so independent verification of the full chain is not yet possible), and the internet-facing exposure population is relatively small (~300–700 instances globally), meaning the most common attack path requires internal network access first.

Why not lower?

Downgrading below CRITICAL is not defensible. The component is canonically a high-value-role target (firewall management plane, 100% of installs occupy this role), active exploitation is confirmed with KEV listing, the hard-coded credentials provide zero-friction initial access, the chain to root is proven in the wild, and the blast radius is fleet-scale. Even if the initial access requires internal network position, an attacker who is already inside (the typical post-phishing position) gets immediate, frictionless access to the most sensitive management system in the network. The floor for this class of vulnerability on this class of target is CRITICAL.

1. Isolate FMC management interface to a dedicated, hardened management VLAN immediately — Restrict FMC web UI access (TCP 443) to a jump host or PAW (Privileged Access Workstation) on a dedicated management network segment. This is the single highest-impact compensating control because it removes the attacker's network path. Deploy within the noisgate mitigation SLA of ≤ 3 days — but given active exploitation, treat as same-day.
2. Block the hard-coded account at the network/authentication layer — If your FMC integrates with an external authentication source (LDAP/RADIUS/SAML), ensure the built-in account cannot bypass external auth. Monitor and alert on any authentication attempt using the hard-coded username. Deploy within hours.
3. Apply the vendor hot fix — Install the appropriate branch-specific hot fix (e.g., 7.4.7.1-3 for 7.4.x, 10.0.1.1-2 for 10.0.x). This is the only definitive remediation — it removes the hard-coded credentials. Deploy within the noisgate mitigation SLA of ≤ 3 days. For 7.3.x users: migrate to a supported branch immediately as no fix is available.
4. Rotate all credentials, keys, and certificates on the FMC — Per Cisco's advisory, if compromise is suspected, rotate all user accounts, API keys, and TLS certificates on the FMC. The hard-coded account may have been used to exfiltrate credential material.
5. Hunt for IoCs on all FMC instances — Run cat /var/log/messages | grep license in expert mode on every FMC. Look for /var/tmp/license.tmp and any package_info.pl invocations as root. If found, treat the FMC as compromised and initiate incident response.

Run this script on each FMC appliance via SSH in expert mode (requires root/admin shell access). Example: ssh [email protected] then enter expert mode with expert, then execute the script. Requires root privileges to read system files.

#!/bin/bash
# CVE-2026-20316 Detection Script for Cisco Secure FMC
# Run on FMC appliance in expert mode as root
# Checks: (1) vulnerable version, (2) indicators of compromise

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "=== CVE-2026-20316 Check ==="
echo "Cisco Secure FMC Static Credential Vulnerability"
echo ""

# Check 1: Get FMC version
VERSION_FILE="/etc/sf/ims.conf"
if [ -f "$VERSION_FILE" ]; then
    FMC_VERSION=$(grep 'VERSION' "$VERSION_FILE" 2>/dev/null | head -1 | cut -d'=' -f2 | tr -d '[:space:]')
else
    FMC_VERSION=$(rpm -q --qf '%{VERSION}' sf-base 2>/dev/null || echo "UNKNOWN")
fi

echo "Detected FMC version: $FMC_VERSION"

# Check 2: Determine if version is in vulnerable range
VULNERABLE=0
if echo "$FMC_VERSION" | grep -qE '^7\.0\.[0-9]($|\.)'; then
    VULNERABLE=1
    HOTFIX="7.0.9.1-3"
elif echo "$FMC_VERSION" | grep -qE '^7\.2\.[0-9]'; then
    VULNERABLE=1
    HOTFIX="7.2.11.1-4"
elif echo "$FMC_VERSION" | grep -qE '^7\.3\.'; then
    VULNERABLE=1
    HOTFIX="NONE-MIGRATE"
elif echo "$FMC_VERSION" | grep -qE '^7\.4\.[0-7]($|\.)'; then
    VULNERABLE=1
    HOTFIX="7.4.7.1-3"
elif echo "$FMC_VERSION" | grep -qE '^7\.6\.[0-5]($|\.)'; then
    VULNERABLE=1
    HOTFIX="7.6.5.1-2"
elif echo "$FMC_VERSION" | grep -qE '^7\.7\.'; then
    VULNERABLE=1
    HOTFIX="7.7.12.1-2"
elif echo "$FMC_VERSION" | grep -qE '^10\.0\.[01]($|\.)'; then
    VULNERABLE=1
    HOTFIX="10.0.1.1-2"
fi

# Check 3: Look for indicators of compromise
IOC_FOUND=0
if [ -f "/var/tmp/license.tmp" ]; then
    IOC_FOUND=1
    echo -e "${RED}[!] IoC DETECTED: /var/tmp/license.tmp exists${NC}"
fi

if grep -q 'package_info.pl' /var/log/messages 2>/dev/null; then
    IOC_FOUND=1
    echo -e "${RED}[!] IoC DETECTED: package_info.pl found in /var/log/messages${NC}"
fi

if grep -q 'license' /var/log/messages 2>/dev/null; then
    LICENSE_ENTRIES=$(grep -c 'license' /var/log/messages 2>/dev/null)
    echo -e "${YELLOW}[*] Found $LICENSE_ENTRIES license-related log entries — review manually${NC}"
fi

# Output verdict
echo ""
if [ $IOC_FOUND -eq 1 ]; then
    echo -e "${RED}COMPROMISED — Indicators of active exploitation detected. Initiate IR immediately.${NC}"
    exit 2
elif [ $VULNERABLE -eq 1 ]; then
    echo -e "${RED}VULNERABLE — FMC $FMC_VERSION is affected by CVE-2026-20316${NC}"
    if [ "$HOTFIX" = "NONE-MIGRATE" ]; then
        echo -e "${RED}No fix available for 7.3.x — migrate to a supported branch immediately${NC}"
    else
        echo "Apply hot fix: $HOTFIX"
    fi
    exit 1
elif [ "$FMC_VERSION" = "UNKNOWN" ]; then
    echo -e "${YELLOW}UNKNOWN — Could not determine FMC version. Verify manually.${NC}"
    exit 3
else
    echo -e "${GREEN}PATCHED — FMC $FMC_VERSION does not appear to be in the vulnerable range${NC}"
    exit 0
fi

Sources

1. Cisco Security Advisory — cisco-sa-fmc-static-cred-BET3Cjh
2. BleepingComputer — Cisco warns of FMC static credential flaw exploited in zero-day attacks
3. CISA Known Exploited Vulnerabilities Catalog
4. NVD — CVE-2026-20316
5. CISA Flags Actively Exploited Cisco Firewall Manager Flaw — Windows News
6. VulnCheck — Cisco FMC Auth Bypass Analysis
7. THREATINT — CVE-2026-20316
8. GreyNoise — Exploitation Activity Precedes Vulnerability Disclosure