Cisco is alerting customers to a critical security vulnerability, **CVE-2026-20316**, affecting its **Secure Firewall Management Center (FMC)** software. This high-severity flaw, caused by static credentials for a low-privilege account built into the software, is currently being exploited in zero-day attacks. An unauthenticated, remote attacker can leverage these static credentials to log into an affected system, gaining access to sensitive data associated with that account. While **CVE-2026-20316** has a CVSS score of 5.3, **Cisco** has assigned it a High severity rating. This elevated rating is due to the potential for attackers to combine this initial access with other, undisclosed FMC vulnerabilities to achieve privilege escalation. ### Affected Products and Patches The vulnerability impacts **Cisco Secure FMC Software** across all device configurations. However, it does not affect **Cloud-Delivered FMC**, **Firewall Device Manager**, **Secure Firewall ASA Software**, **Secure Firewall Threat Defense Software**, or **Security Cloud Control**. **Cisco** has released hot fixes for **Secure FMC** releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no known workarounds, making immediate installation of these fixes crucial for affected customers. ### Active Exploitation and Detection **Cisco** became aware of active exploitation in July 2026. However, details regarding the start date of these attacks, the identity of the threat actors, or the targeted organizations have not been disclosed. The vulnerability was reported by **Jimi Sebree** of **Horizon3.ai**. The company notes that the attack surface is reduced when the FMC management interface is not directly exposed to the public internet. Administrators can check for signs of compromise by reviewing the `/var/log/messages` log file. Running the following command in expert mode can help identify suspicious activity: ```bash cat /var/log/messages | grep license Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm ``` This entry shows the FMC web process, operating under the `www` account, invoking **Cisco**'s `package_info.pl` script as `root` and supplying the `/var/tmp/license.tmp` file. If this indicator of compromise (IOC) is found, administrators should immediately rotate all user credentials, keys, and certificates on the affected FMC device. Organizations believing they are compromised should also contact the **Cisco TAC** for assistance with recovery efforts. ### Critical Authentication Bypass Also Patched In a related development, **Cisco** also updated an advisory for a separate critical FMC authentication bypass vulnerability, **CVE-2026-20079**, which carries a maximum CVSS score of 10.0. This flaw allows an unauthenticated, remote attacker to bypass authentication and execute scripts and commands with root privileges by sending specially crafted HTTP requests to an affected FMC device. The vulnerability stems from an improper system process created during system boot. Unlike **CVE-2026-20316**, **CVE-2026-20079** does not require any credentials or prior access to the device. **Cisco** initially disclosed **CVE-2026-20079** in March 2026 and updated the advisory on July 29 to include a second bug ID, additional hot fixes, and indicators of compromise. However, **Cisco** states that it is not aware of any malicious exploitation of this particular vulnerability. Interestingly, **Cisco** published the same `/var/tmp/license.tmp` indicator in both advisories, without clarifying whether the two vulnerabilities are connected. Furthermore, the description of **CVE-2026-20079** suggests it can be exploited independently to achieve root access, without utilizing the static credentials associated with **CVE-2026-20316**. The same **Secure FMC** hot fixes released for **CVE-2026-20316** also address **CVE-2026-20079**. Again, no full workarounds are available, underscoring the importance of applying the patches.