CVE-2026-20316 is a static-credential bug in Secure FMC that's already on CISA's Known Exploited Vulnerabilities list, with a federal patch deadline of August 1.
Cisco's Secure Firewall Management Center — the console network admins use to run their actual firewalls — shipped with a login nobody was supposed to find. CVE-2026-20316 is a static, hardcoded credential for a low-privilege account built into FMC itself. Cisco disclosed it on July 29, 2026, and confirmed it's already being exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog the same day.
What the static account actually is
FMC is the management layer that sits above Cisco's Secure Firewall (formerly Firepower) appliances — the box that pushes policy, pulls logs, and controls the firewalls actually sitting on the network edge. Cisco's advisory says the flaw comes from static credentials for a low-privilege account built into the software. An unauthenticated remote attacker who knows those credentials can log in directly and pull whatever data that account is allowed to see.
On its own, a low-privilege account doesn't sound like much. Cisco's own severity rating explains why it still matters: the access this account grants can be combined with other FMC vulnerabilities to escalate privileges further. A 5.3 CVSS score usually gets triaged behind the week's 9-point bugs — Cisco bumped this one to High specifically so it wouldn't get buried in that pile.
Affected FMC versions
FMC 7.0
Status
Hotfix available
FMC 7.2
Status
Hotfix available
FMC 7.4
Status
Hotfix available
FMC 7.6
Status
Hotfix available
FMC 7.7
Status
Hotfix available
FMC 10.0
Status
Hotfix available
Status
FMC 7.0
Hotfix available
FMC 7.2
Hotfix available
FMC 7.4
Hotfix available
FMC 7.6
Hotfix available
FMC 7.7
Hotfix available
FMC 10.0
Hotfix available
How defenders are catching it
Suspicious entries referencing /var/tmp/license.tmp in /var/log/messages.
The www process invoking package_info.pl as root — not normal behavior for that process.
Login activity on the built-in low-privilege account outside your known admin access patterns.
FMC sits above Cisco's Secure Firewall appliances, controlling policy for the actual network perimeter — which is why a static-credential bug here carries outsized risk. · Unsplash
Timeline: zero-day to KEV in one week
Mid-to-late July 2026
Cisco detects active exploitation of the static-credential account in the wild.
July 29, 2026
Cisco publishes the advisory for CVE-2026-20316 along with hotfixes and indicators of compromise.
July 29, 2026
CISA adds CVE-2026-20316 to the Known Exploited Vulnerabilities catalog.
August 1, 2026
Deadline for U.S. federal civilian agencies to apply the fix under CISA's binding directive.
What to do right now
Identify every FMC instance on 7.0, 7.2, 7.4, 7.6, 7.7, or 10.0 and apply Cisco's hotfix immediately — there is no workaround to fall back on.
Check `/var/log/messages` for the `/var/tmp/license.tmp` reference and unexpected `package_info.pl` execution as root.
Review login activity on the built-in low-privilege account for anything outside expected admin access.
4
If FMC is internet-reachable at all, treat that as a standalone finding to fix regardless of this CVE — management interfaces shouldn't be exposed to begin with.
CVE-2026-20316, quickly
Is there a workaround if I can't patch right away?
No. Cisco's advisory states there are no workarounds — the hotfix is the only remediation.
Why is a 5.3 CVSS score being treated as urgent?
Cisco rated it High severity, not Medium, because the low-privilege account's access can be chained with other FMC vulnerabilities to escalate privileges — and it's confirmed under active exploitation.
Is this on CISA's Known Exploited Vulnerabilities list?
Yes, added July 29, 2026, with an August 1, 2026 remediation deadline for U.S. federal agencies.
Who found the bug?
Jimi Sebree of Horizon3.ai reported it to Cisco.
Static, hardcoded credentials keep showing up in management-plane software this year — it's the same root cause behind N-able N-central's exploited auth bypass and Arista's VeloCloud Orchestrator zero-day. All three are the same lesson from three different vendors: a hidden account with a fixed password is a liability the moment anyone finds it, and on management infrastructure sitting above your actual defenses, someone always eventually does. If FMC is anywhere in your stack, this is not a next-sprint item.
