CVE-2026-20316 gives anyone the login to a low-privilege account baked into Cisco Secure FMC — and Cisco's own team says it was already being used in the wild before a patch existed.
Cisco just confirmed that attackers were breaking into Secure Firewall Management Center appliances using a password Cisco itself built into the software — and they were doing it before any patch existed. CVE-2026-20316 is a static-credential flaw in a low-privilege account baked into Cisco Secure FMC, and Cisco's own PSIRT says exploitation was already underway in July, weeks before a fix shipped. CISA added it to the Known Exploited Vulnerabilities catalog on July 29 and gave federal agencies until August 1 — three days — to patch.
A CVSS score of 5.3 isn't supposed to mean 'patch in 72 hours'
On paper, 5.3 is medium. Most security teams triage anything under 7 behind the genuinely critical stuff. That's exactly the read this bug punishes. The static account only exposes data available to a low-privilege role by itself — but Cisco's advisory frames it as a stepping stone: log in with the built-in credentials, then chain into a separate FMC bug, and you're escalating toward the kind of access an actual attacker wants. Score the entry point alone and you get 5.3. Score what it enables, and CISA's answer was a three-day patch window for the US federal government.
5.3
CVSS score
Rated 'High' by Cisco despite the number
Jul 29, 2026
KEV added
Confirmed active exploitation
Aug 1, 2026
Federal deadline
3 days after the KEV listing
6
FMC branches patched
7.0, 7.2, 7.4, 7.6, 7.7, 10.0
We've flagged this exact gap between headline severity and real risk before, just from the opposite direction — Microsoft called a SharePoint bug 'Moderate,' the NVD scored it 9.8, and it was already being exploited. This is the same lesson from the low-number side: a 5.3 that earned a three-day emergency patch order because of what it unlocks downstream. If your patch process only escalates on the raw score, you're going to miss the next one of these too.
FMC manages the policy layer for Cisco's firewall fleet — a foothold here can reach further than the CVSS score alone suggests. · Unsplash
What Cisco actually found, and how to check if you're affected
Cisco's advisory points to a specific fingerprint, according to Help Net Security's reporting: exploitation attempts show up as execution of package_info.pl referencing /var/tmp/license.tmp in system logs. That's the indicator worth grepping for right now, not just 'did we apply the hotfix.' Cisco's own guidance goes further than 'install the patch,' too — it explicitly recommends rotating every credential, key and certificate on the appliance, because a static account being live in an attacker's hands for weeks means you can't assume the door's closed just by turning the lock.
At a minimum, Cisco recommends that customers rotate all user credentials, keys, and certificates on the Cisco Secure FMC device because active exploitation of this vulnerability has been ongoing.
Cisco PSIRT advisory
Hotfix by FMC branch
FMC 7.0
Hotfix file
Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3
FMC 7.2
Hotfix file
Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4
FMC 7.4
Hotfix file
Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3
FMC 7.6
Hotfix file
Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2
FMC 7.7
Hotfix file
Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2
FMC 10.0
Hotfix file
Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2
Hotfix file
FMC 7.0
Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3
FMC 7.2
Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4
FMC 7.4
Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3
FMC 7.6
Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2
FMC 7.7
Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2
FMC 10.0
Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2
What to do today
Identify your FMC version and download the matching hotfix — 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 all have one.
Grep system logs for package_info.pl executions referencing /var/tmp/license.tmp — Cisco's own indicator of compromise.
Rotate every credential, key and certificate on the FMC appliance, not just the account tied to this CVE.
If your FMC management interface is reachable from the public internet, restrict it to a management VPN or allowlist immediately — that exposure is what turns this from low-risk into active.
Cisco FMC CVE-2026-20316: quick answers
Is this being actively exploited right now?
Yes. Cisco's PSIRT confirmed exploitation in July 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on July 29 — that listing only happens with confirmed real-world attacks.
Why is a 5.3 CVSS score treated as an emergency?
The static credential alone only reaches low-privilege data, but Cisco warns it can be chained with other FMC vulnerabilities to escalate access — the isolated score understates what it actually enables.
Do I need to do anything beyond installing the hotfix?
Yes — Cisco explicitly recommends rotating all credentials, keys and certificates on the device, since the static account may already have been used by an attacker before you patch.
Which FMC versions are affected?
Cisco shipped hotfixes for FMC 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0, covering the actively supported branches.
This is the second time this year a supposedly boring CVSS number has masked an actively exploited hole — the SharePoint bug Microsoft rated Moderate is the other one, and the pattern echoes the pre-auth Windows RDP flaw we covered last month too. If your vulnerability process ranks purely by CVSS, add 'is this in CISA's KEV catalog' as a second gate — that list only contains bugs confirmed exploited in the wild, and it doesn't care what the score says.
