CVE-2026-20316 · Cisco Secure Firewall Management Center web interface hardcoded…

01 · The Real Story

Someone welded a spare key to the front door of every bank vault in town, and three gangs already have copies

CVE-2026-20316 is a CWE-259 Use of Hard-coded Password flaw in Cisco Secure Firewall Management Center (FMC), the centralized management appliance that controls policy, configuration, and credential storage for Cisco Secure Firewall (FTD) fleets. Every on-premises FMC deployment across versions 7.0.0–7.0.9, 7.2.0–7.2.11, 7.3.x (no fix — must migrate), 7.4.0–7.4.7, 7.6.0–7.6.5, 7.7.0–7.7.12, and 10.0.0–10.0.1 ships with identical static credentials for a built-in low-privileged web interface account. An unauthenticated remote attacker who can reach the FMC web UI simply logs in with these hardcoded credentials — no brute-force, no exploit chain, no user interaction — and immediately gains read access to sensitive operational data including managed-device configurations, network topology, and VPN settings. Cloud-Delivered FMC (cdFMC), FDM, ASA Software, and FTD Software are not affected.

Cisco's own CVSS score of 5.3 MEDIUM drastically understates the real-world severity, and Cisco themselves acknowledged this by assigning a Security Impact Rating (SIR) of HIGH — a rare override of their own CVSS math. The reason: these static credentials serve as the deterministic, zero-complexity entry point for a documented privilege escalation chain with CVE-2026-20079 (CVSS 10.0 authentication bypass → root RCE), which Cisco Talos confirmed is being actively exploited by Sandworm (Russian state-sponsored, UAT-11823), Qilin ransomware affiliates (UAT-11988), and an unattributed cluster (UAT-12197). The credentials are identical across every vulnerable FMC on Earth. There are no workarounds. CISA added this to KEV on July 29, 2026, with an August 1 deadline — a 3-day remediation window that signals maximum urgency. Treating this as a standalone MEDIUM is a mistake that could cost you your firewall fleet.

"Hardcoded credentials on your firewall management plane, exploited by Sandworm and Qilin — patch now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Reach the FMC web interface

The attacker identifies a Cisco Secure FMC web interface either from the internet (300–700 instances exposed per Censys/FOFA as of September 2026) or from an internal network position. FMC management interfaces listen on HTTPS/443 by default. Most enterprise FMCs sit on management VLANs, but any attacker with an initial internal foothold — phishing, VPN compromise, supply-chain implant — can reach them.

Conditions required:

Network connectivity to FMC management interface (TCP/443)

Where this breaks in practice:

Best-practice deployments restrict FMC to an out-of-band management network, reducing internet exposure to ~300-700 instances globally
Internal-only FMCs still reachable from any host on the management VLAN or any compromised jump host

Detection/coverage: Censys/Shodan dork: services.software.product:"Firepower Management Center". GreyNoise may tag scanning for FMC login pages.

STEP 02

Authenticate with hardcoded static credentials

The attacker logs into the FMC web UI using the built-in static account credentials that ship identically on every affected deployment. This requires zero brute-force and zero exploit development — the credentials are deterministic. The login succeeds as a low-privileged user with read access to sensitive system data. Exploitation is trivial once the credentials are known; Horizon3.ai's Jimi Sebree disclosed the flaw and the research community has identified the account.

Conditions required:

Knowledge of the static credentials (publicly researchable post-disclosure)
FMC running a vulnerable version (7.0–10.0 without hotfix)

Where this breaks in practice:

None — credentials are identical across all affected deployments, no complexity barrier

Detection/coverage: FMC audit logs will show the low-privileged account authenticating. Monitor for unexpected logins to this built-in account. SIEM correlation on FMC authentication events.

STEP 03

Harvest sensitive data from the low-privileged session

With the low-privileged session, the attacker reads managed-device configurations, network topology, firewall rule sets, VPN configurations, and potentially cached credentials or API tokens stored on the FMC. This intelligence alone is devastating for a network security management platform — it reveals the defender's entire firewall architecture.

Conditions required:

Authenticated low-privileged FMC session from step 2

Where this breaks in practice:

Data exposure is limited to what the low-privileged account can access — not full admin

Detection/coverage: Monitor FMC access logs for bulk data retrieval or API enumeration from the static account.

STEP 04

Chain with CVE-2026-20079 for root escalation

The attacker pivots from the low-privileged session to exploit CVE-2026-20079, an authentication bypass that allows crafted HTTP requests to execute commands as root. The chain uses the package_info.pl utility and a malicious /var/tmp/license.tmp file to achieve arbitrary command execution with root privileges. All three documented threat clusters (Sandworm/UAT-11823, Qilin/UAT-11988, UAT-12197) use this exact chain in the wild.

Conditions required:

CVE-2026-20079 also unpatched on the same FMC (same affected version ranges)
Low-privileged session from step 2 as the launch point

Where this breaks in practice:

Requires CVE-2026-20079 to also be present — but since both CVEs affect the same version ranges, an unpatched FMC almost certainly has both

Detection/coverage: IOC: zgrep "package_info.*license" /var/log/messages* — presence of /var/tmp/license.tmp indicates exploitation. Cisco TAC engagement required.

STEP 05

Establish persistence and compromise the firewall fleet

With root access on FMC, the attacker deploys persistence mechanisms — Sandworm installs Cyclops Blink implants, UAT-12197 drops web shells (home.jsp) in the CSM Tomcat webroot, and Qilin affiliates harvest Active Directory and database credentials. From FMC, the attacker can push malicious firewall policies to all managed FTD devices, disable security controls, exfiltrate traffic, or pivot deeper into the network. This is fleet-scale compromise of the organization's entire firewall infrastructure.

Conditions required:

Root access on FMC from step 4

Where this breaks in practice:

None once root is achieved — FMC is the authoritative management plane for all managed firewalls

Detection/coverage: File integrity monitoring on FMC filesystem, especially /var/tmp/, Tomcat webroot, and cron directories. Network detection for C2 callbacks from FMC management IP.

03 · Compensating Control

CRITICAL 9.0→HIGH 7.5

SEVERITY REDUCED

Restrict FMC management interface to a dedicated out-of-band management network with strict ACLs — The single most impactful control is ensuring the FMC web interface is reachable only from authorized jump hosts on a dedicated management VLAN with explicit allow-list ACLs. This eliminates internet-based exploitation entirely and dramatically reduces the internal attack surface. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Configure firewall rules or switch ACLs to permit TCP/443 to FMC only from specific management workstation IPs.

CRITICAL 9.0→IGNORE 0.0

SEVERITY REDUCED

Apply Cisco hotfix to the FMC appliance immediately — Install the applicable hotfix: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, or 10.1.0. Version 7.3.x has no fix — migrate to 7.4.8+ or 7.6.6+. This is the only complete remediation. Per the noisgate remediation SLA for CRITICAL, complete patching within 90 days — but given active exploitation and KEV listing, treat this as immediate (hours, not days). Schedule emergency maintenance.

CRITICAL 9.0→CRITICAL 9.0

Monitor FMC logs for IOCs and rotate all stored credentials if compromise detected — Run zgrep "package_info.*license" /var/log/messages* on every FMC immediately. Check for /var/tmp/license.tmp and unexpected JSP files in the Tomcat webroot. If any IOCs are found, assume full compromise: rotate all credentials, certificates, and API tokens stored on FMC, rotate managed-device credentials, engage Cisco TAC, and audit firewall policies on all managed FTDs for unauthorized changes. Deploy within 3 days per noisgate mitigation SLA.

CRITICAL 9.0→HIGH 8.0

SEVERITY REDUCED

Deploy network detection rules for FMC exploitation patterns — Implement IDS/IPS signatures and SIEM correlation rules to detect: (1) authentication attempts to the FMC web UI using the known static account, (2) outbound connections from FMC management IPs to unexpected destinations (C2), (3) file creation in /var/tmp/ on FMC, (4) web shell indicators in Tomcat webroot paths. Snort/Suricata rules for the package_info.pl abuse pattern. This provides detection but does not prevent exploitation. Deploy within 3 days.

What doesn't work

WAF in front of FMC — The attack uses valid credentials to authenticate through the normal login flow. A WAF cannot distinguish a legitimate admin login from an attacker using the static credentials. The HTTP requests are well-formed and application-valid.
MFA on FMC web UI — Cisco Secure FMC does not natively support MFA on the local web interface for built-in accounts. The hardcoded account bypasses any external authentication integration because it is a local system account.
Disabling the static account — There is no documented method to disable or change the password of the hardcoded account without applying the hotfix. Attempting manual account manipulation on FMC may break system functionality.
IPS signatures alone — The initial exploitation uses standard HTTPS authentication. Encrypted traffic inspection would be required, and even then the login is syntactically identical to a legitimate session.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Confirmed active zero-day exploitation since at least July 2026. Three distinct threat clusters documented by Cisco Talos: UAT-11823 (Sandworm/Russian state-sponsored — Cyclops Blink deployment), UAT-11988 (Qilin ransomware — credential harvesting and encryption), UAT-12197 (unattributed — web shell persistence). Campaigns chain CVE-2026-20316 with CVE-2026-20079 (CVSS 10.0) for root-level compromise.
CISA KEV Status	Listed July 29, 2026. Remediation deadline: August 1, 2026 (3-day window — extremely aggressive, signaling maximum urgency from CISA).
EPSS Score	0.35096 (35.1%) — well above the median, placing this in the top tier of exploitation probability. Consistent with confirmed active exploitation.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` — Vendor base score 5.3 MEDIUM. Network-accessible, zero complexity, no privileges required, no user interaction. The C:L rating reflects standalone low-privileged read access, but massively understates the chained impact.
Proof-of-Concept	No standalone public PoC identified on pocindex.io or GitHub as of October 2026. However, the vulnerability is trivially exploitable — it requires only knowledge of static credentials, not exploit code. The credentials are deterministic and identical across all affected deployments. Horizon3.ai's research provides sufficient detail for reproduction.
Affected Versions	Cisco Secure FMC on-premises: 7.0.0–7.0.9, 7.2.0–7.2.11, 7.3.0–7.3.1.2 (no fix, must migrate), 7.4.0–7.4.7, 7.6.0–7.6.5, 7.7.0–7.7.12, 10.0.0–10.0.1. Cloud-Delivered FMC (cdFMC) is NOT affected.
Fixed Versions	7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0. Version 7.3.x has no fix — customers must migrate to a supported branch. Hot fixes released July 29, 2026.
Internet Exposure	Censys and FOFA identify 300–700 internet-exposed FMC instances globally as of September 2026. FMC is architecturally designed for out-of-band management and should never be internet-facing. However, the far larger attack surface is internal — any attacker on the management network can reach FMC.
Disclosure & Attribution	Discovered by Jimi Sebree of Horizon3.ai. Disclosed July 29, 2026. Cisco PSIRT became aware of active exploitation in July 2026. Cisco advisory ID: cisco-sa-fmc-static-cred-BET3Cjh.
Indicators of Compromise	Check with: `zgrep "package_info.license" /var/log/messages`. Presence of `/var/tmp/license.tmp` indicates exploitation. Suspicious log entry pattern: `sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm`. Also look for unexpected JSP files in the CSM Tomcat webroot.

Sources.

05 · The Call

Final Verdict

↑ UPGRADED to CRITICAL (9.0/10)

Why this verdict

Active zero-day exploitation by nation-state and ransomware actors: Three distinct threat clusters — including Russian military-linked Sandworm and Qilin ransomware — are actively exploiting this vulnerability in the wild. This is not theoretical; it's happening now, confirmed by Cisco Talos, CISA KEV (3-day deadline), and multiple threat intelligence firms.
Zero-complexity, deterministic exploitation: Static credentials identical across every affected FMC deployment mean there is no exploit development, no brute-force, no race condition — just a login. The CVSS AC:L and PR:N ratings are accurate but the 5.3 score fails to capture that this is a skeleton key for every FMC on the planet.
Documented privilege escalation chain to root: CVE-2026-20316 chains with CVE-2026-20079 (CVSS 10.0) to achieve root-level command execution. Both CVEs affect the same version ranges, so any unpatched FMC is almost certainly vulnerable to both. The chain is actively used by all three documented threat clusters.
Role multiplier: Cisco Secure FMC is canonically a high-value-role component — it is the centralized management plane for the organization's entire Cisco Secure Firewall fleet. 100% of FMC installs serve this role by definition. A compromised FMC grants the attacker: (1) read/write access to firewall policies across all managed FTD devices → fleet-scale impact, (2) stored credentials for managed devices → lateral movement, (3) network topology and VPN configurations → intelligence for further compromise, (4) ability to disable or weaken security controls across the fleet → defense-evasion at enterprise scale. The blast radius is fleet-scale to domain-scale. This meets the CRITICAL floor: the affected component is canonically high-value (network security management plane), the chain succeeds in this role, and the outcome is fleet-wide firewall compromise.
No workaround available: Cisco confirms there are no workarounds. The only remediation is applying the hotfix. Network isolation of the management interface reduces but does not eliminate exposure — any internal attacker can still reach it.

Why not higher?

A 9.0 is already near the ceiling. We stop short of 10.0 because the standalone vulnerability (without chaining CVE-2026-20079) provides only low-privileged read access — not direct root or arbitrary code execution. The full chain requires a second unpatched CVE, which is a dependency even if it's almost always present in practice. Additionally, best-practice FMC deployments restrict the management interface to dedicated management networks, which does provide meaningful friction for external attackers.

Why not lower?

Downgrading below CRITICAL would ignore the deployment-role floor: FMC is definitionally a fleet-scale security management platform, and the documented chain (actively exploited by Sandworm and Qilin) ends in root-level compromise of that platform. The credentials are identical across all deployments — this is not a configuration-dependent vulnerability but a universal backdoor. CISA's 3-day KEV deadline and Cisco's own SIR override from MEDIUM to HIGH both signal that the vendor's CVSS score is inadequate. Even if we discount internet exposure to ~500 instances, the internal attack surface includes every FMC reachable from any compromised management-network host, which is a much larger population.

06 · Verification

Crowdsourced verification payload.

Run this script on each Cisco Secure FMC appliance via SSH as admin (or root via expert mode). Example: ssh [email protected] 'bash -s' < check_cve_2026_20316.sh. The script checks the installed FMC software version against known-vulnerable ranges and scans for active exploitation indicators. No elevated privileges needed for version check; root recommended for full IOC scan.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash
# CVE-2026-20316 - Cisco Secure FMC Static Credential Vulnerability Check
# Run on FMC appliance via SSH. Outputs VULNERABLE / PATCHED / UNKNOWN.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

echo "=== CVE-2026-20316 Check: Cisco Secure FMC Static Credentials ==="
echo "Date: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
echo ""

# Attempt to determine FMC version from multiple sources
FMC_VERSION=""
if [ -f /etc/sf/ims.conf ]; then
    FMC_VERSION=$(grep -oP 'CURRENT_VERSION=\K[0-9.]+' /etc/sf/ims.conf 2>/dev/null || true)
fi
if [ -z "$FMC_VERSION" ]; then
    FMC_VERSION=$(rpm -q --queryformat '%{VERSION}' SFDataCorrelator 2>/dev/null || true)
fi
if [ -z "$FMC_VERSION" ]; then
    FMC_VERSION=$(cat /usr/local/sf/bin/sf_version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9.]+' || true)
fi

if [ -z "$FMC_VERSION" ]; then
    echo "ERROR: Could not determine FMC version."
    echo "Verify manually: show version (in FMC CLI)"
    echo "RESULT: UNKNOWN"
    exit 2
fi

echo "Detected FMC Version: $FMC_VERSION"
echo ""

# Extract major.minor for branch matching
MAJOR_MINOR=$(echo "$FMC_VERSION" | grep -oP '^[0-9]+\.[0-9]+')

# Compare versions using sort -V
ver_lt() { [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]; }

VULNERABLE=0
FIX_VERSION=""

case "$MAJOR_MINOR" in
    7.0)  FIX_VERSION="7.0.10";  ver_lt "$FMC_VERSION" "$FIX_VERSION" && VULNERABLE=1 ;;
    7.2)  FIX_VERSION="7.2.12";  ver_lt "$FMC_VERSION" "$FIX_VERSION" && VULNERABLE=1 ;;
    7.3)  FIX_VERSION="NONE";    VULNERABLE=1; echo "WARNING: 7.3.x has no fix. Must migrate to 7.4.8+ or 7.6.6+." ;;
    7.4)  FIX_VERSION="7.4.8";   ver_lt "$FMC_VERSION" "$FIX_VERSION" && VULNERABLE=1 ;;
    7.6)  FIX_VERSION="7.6.6";   ver_lt "$FMC_VERSION" "$FIX_VERSION" && VULNERABLE=1 ;;
    7.7)  FIX_VERSION="7.7.13";  ver_lt "$FMC_VERSION" "$FIX_VERSION" && VULNERABLE=1 ;;
    10.0) FIX_VERSION="10.0.2";  ver_lt "$FMC_VERSION" "$FIX_VERSION" && VULNERABLE=1 ;;
    10.1|11.*) VULNERABLE=0 ;;
    *)    echo "Unrecognized branch: $MAJOR_MINOR"; echo "RESULT: UNKNOWN"; exit 2 ;;
esac

# IOC checks
IOC_FOUND=0
echo "--- IOC Scan ---"
if [ -f /var/tmp/license.tmp ]; then
    echo "!! IOC: /var/tmp/license.tmp EXISTS - possible exploitation artifact"
    IOC_FOUND=1
else
    echo "OK: /var/tmp/license.tmp not present"
fi

if zgrep -q 'package_info.*license' /var/log/messages* 2>/dev/null; then
    echo "!! IOC: package_info+license pattern found in /var/log/messages"
    echo "   Run: zgrep 'package_info.*license' /var/log/messages* | head -20"
    IOC_FOUND=1
else
    echo "OK: No package_info+license pattern in logs"
fi

# Check for web shell artifacts
TOMCAT_WEBROOT="/var/opt/CSCOpx/MDC/tomcat/vms/webapps/ROOT"
if [ -d "$TOMCAT_WEBROOT" ]; then
    SUSPECT_JSP=$(find "$TOMCAT_WEBROOT" -name '*.jsp' -newer /etc/sf/ims.conf 2>/dev/null | head -5)
    if [ -n "$SUSPECT_JSP" ]; then
        echo "!! IOC: Recently modified JSP files in Tomcat webroot:"
        echo "$SUSPECT_JSP"
        IOC_FOUND=1
    fi
fi

echo ""
echo "--- Verdict ---"
if [ $VULNERABLE -eq 1 ]; then
    echo "RESULT: VULNERABLE"
    echo "FMC $FMC_VERSION is affected by CVE-2026-20316"
    [ "$FIX_VERSION" != "NONE" ] && echo "Upgrade to: $FIX_VERSION or later"
    [ $IOC_FOUND -eq 1 ] && echo "!! ACTIVE COMPROMISE INDICATORS DETECTED - Engage Cisco TAC immediately"
    exit 1
else
    echo "RESULT: PATCHED"
    echo "FMC $FMC_VERSION is not affected by CVE-2026-20316"
    [ $IOC_FOUND -eq 1 ] && echo "WARNING: IOCs found despite patched version - investigate prior compromise"
    exit 0
fi