Cisco has confirmed active exploitation of a static credential vulnerability in Secure Firewall Management Center Software, tracked as CVE-2026-20316, with CISA adding the flaw to the Known Exploited Vulnerabilities catalog. The company also disclosed a separate critical authentication bypass, CVE-2026-20079, that carries the maximum CVSS 10.0 severity and grants unauthenticated remote root access through crafted HTTP requests.
The Active Exploitation of CVE-2026-20316
CVE-2026-20316 involves static credentials for a low-privilege account embedded in Cisco Secure FMC Software, allowing an unauthenticated remote attacker to log in and access sensitive data. Cisco assigned the vulnerability a High severity CVSS 5.3, noting that the access it provides can be combined with other FMC vulnerabilities to elevate privileges, though the company has not publicly identified which additional vulnerabilities might be chained with this flaw. Cisco confirmed active exploitation began in July and has not disclosed the specific attackers, targets, or timeline of the observed attacks.
The Indicator of Compromise for FMC Compromise
Cisco has identified a log-based indicator of compromise for organizations assessing whether they have been targeted. Log entries containing the path /var/tmp/license.tmp in /var/log/messages suggest possible exploitation. The company recommends that organizations monitoring their FMC deployments check for this pattern and contact Cisco TAC if compromise is suspected. This indicator gives defenders a concrete forensic signal in what is otherwise a difficult-to-detect static credential attack. The presence of a specific log artifact is unusual for a static credential vulnerability, where successful logins typically generate only routine authentication events that blend into normal system logs.
The Separately Patched Critical FMC Authentication Bypass
Alongside the active exploitation advisory, Cisco patched CVE-2026-20079, an authentication bypass in FMC with a CVSS 10.0 critical severity. The flaw enables an unauthenticated attacker to gain root access to the FMC appliance through specially crafted HTTP requests. Cisco has not confirmed any active exploitation of CVE-2026-20079, but its maximum severity and lack of authentication requirement make it a high-priority remediation target. The simultaneous release of both advisories highlights the attack surface concentration in the FMC management layer.
Affected Products and Fix Availability
The vulnerabilities affect on-premises deployments of Cisco Secure FMC Software across multiple releases. Cisco has released hot fixes for releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. No workarounds are available for either CVE. Critically, Cloud-Delivered FMC, Firewall Device Manager, and Secure Firewall ASA or Threat Defense are not affected, limiting the scope to organizations running self-managed FMC deployments. The company recommends applying patches immediately as the primary and only remediation path.
Attack Surface and Risk Context
The FMC serves as the centralized management layer for Cisco firewall infrastructure, giving administrators visibility into security policies and the ability to modify or disable firewall rules across the entire deployment. A compromised FMC, even at the low-privilege level granted by CVE-2026-20316, provides attackers with intelligence about network security configurations and a foothold for further exploitation. The KEV designation indicates CISA considers this vulnerability a known risk to federal agencies and, by extension, to the broader critical infrastructure that relies on Cisco firewall management. Security practitioners have noted that the management interface exposure to the public internet dramatically increases the practical risk — organizations that have not restricted FMC management access to internal networks face a wider attack surface than those following the vendor’s segmentation guidance. Cisco’s advisory explicitly notes that the attack surface is reduced when the FMC management interface is not exposed to the public internet, making network segmentation a critical compensating control where immediate patching is not possible.
Broader Implications for Centralized Security Management Platforms
The two FMC vulnerabilities illustrate a recurring problem in enterprise network security architecture: the centralized management platform that enables efficient administration also presents a single point of compromise. When a management console carries both a static credential vulnerability and an authentication bypass in the same patch cycle, it signals that the control plane itself requires the same rigor of security review as the perimeter devices it manages. For organizations assessing their exposure, the combination of active exploitation, no available workarounds, and the FMC’s central role in firewall management makes this patch cycle particularly urgent. The static credential finding is also notable from a software development perspective — embedded credentials in enterprise software continue to appear despite years of industry awareness about the risks, suggesting that secure credential management during development remains an unresolved challenge for network equipment vendors.
