CISA KEV Alert for Active Zero-Day Exploitation of Cisco FMC

CISA has added a newly disclosed Cisco Secure Firewall Management Center zero-day to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The vulnerability, tracked as CVE-2026-20316, allows unauthenticated remote attackers to log into affected devices using hardcoded static credentials and access sensitive data.

What Happened: Cisco FMC Zero-Day Exposes Networks via Hardcoded Credentials

On July 29, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog. Furthermore, Cisco confirmed that threat actors have been actively exploiting this flaw since earlier this month.

The vulnerability resides in Cisco Secure Firewall Management Center (FMC) Software. It exists because the software ships with static user credentials for a low-privileged account. An unauthenticated attacker can use these hardcoded credentials to log in remotely and access sensitive system data. Cisco assigned the flaw a CVSS score of 5.3. However, the company raised its Security Impact Rating to High because attackers can chain this vulnerability with other FMC flaws to escalate privileges.

Technical Details of the Cisco FMC Static Credential Vulnerability

Cisco Secure Firewall Management Center provides centralized management for Cisco firewalls, policies, and threat intelligence. The FMC management interface is a high-value target because it controls security policy across an entire network perimeter.

CVE-2026-20316 stems from a low-privileged account embedded in the software with static credentials. The attack chain is straightforward:

• The attacker identifies an internet-exposed or reachable Cisco Secure FMC instance
• The attacker logs in using the hardcoded static credentials for the low-privileged account
• The attacker gains access to sensitive data and system configuration information
• The attacker can chain this access with other vulnerabilities to escalate privileges

Cisco noted that the attack surface is reduced if the FMC management interface is not exposed to the public internet. However, many organizations expose management interfaces to remote administrators. Moreover, lateral movement after initial access could enable attackers to reach FMC instances that are not directly internet-facing.

Security researcher Jimi Sebree of Horizon3.ai discovered and reported this flaw. Cisco also updated its advisory for CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure FMC Software with a CVSS score of 10.0. This update included the same indicators of compromise. Therefore, threat actors could potentially chain CVE-2026-20316 with CVE-2026-20079 to achieve arbitrary code execution with root privileges.

Indicators of Compromise

Cisco urges administrators to check for exploitation using the following command in expert mode:

cat /var/log/messages | grep license

If the output includes /var/tmp/license.tmp, the device may have been compromised.

Affected Versions and Patches

Cisco has released hot fixes for multiple FMC Software versions:

• 7.0 — Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
• 7.2 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
• 7.4 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
• 7.6 — Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
• 7.7 — Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
• 10.0 — Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Business and Operational Impact

A compromised firewall management center is one of the worst-case scenarios for enterprise security. The FMC controls security policies, network segmentation rules, and threat intelligence feeds across the entire perimeter. Consequently, an attacker with FMC access can disable protections, create backdoor access rules, or exfiltrate data undetected.

The impact categories include:

• Security policy manipulation: Attackers can modify firewall rules to allow malicious traffic or block security monitoring
• Lateral movement: FMC access provides a pivot point to other network security infrastructure
• Data exfiltration: Sensitive configuration data and network topology information can be stolen
• Persistent backdoors: Attackers can maintain long-term access by embedding hidden policies
• Privilege escalation: Chaining with CVE-2026-20079 enables arbitrary code execution as root

Federal Civilian Executive Branch (FCEB) agencies must apply the fixes by August 1, 2026, under Binding Operational Directive requirements. Private sector organizations should treat this with equal urgency.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Apply Cisco hot fixes immediately. Download and install the appropriate hot fix for your FMC Software version without delay.
2. Check for indicators of compromise. Run the Cisco-provided CLI command to detect potential exploitation via /var/tmp/license.tmp.
3. Restrict FMC management interface access. Ensure the FMC interface is not exposed to the public internet. Use jump hosts or VPN-only access.
4. Review FMC logs and policies. Audit recent policy changes, administrator logins, and configuration modifications for unauthorized activity.
5. Monitor for chained exploitation. Assess whether CVE-2026-20079 is also present and patched, as attackers may combine both vulnerabilities.

Additional Hardening Steps

Organizations should also implement network segmentation for security management infrastructure. Furthermore, deploy multi-factor authentication for all administrative access to FMC and related systems. Finally, conduct regular vulnerability assessments on security management platforms, as these are increasingly targeted by sophisticated threat actors.

Bottom line: Hardcoded credentials in security products are a nightmare scenario. Cisco FMC users should patch immediately, check for compromise indicators, and restrict management interface exposure before attackers exploit this flaw at scale.

Incident Summary

CVE ID / Incident:	CVE-2026-20316 (Cisco Advisory)
Affected Systems:	Cisco Secure Firewall Management Center (FMC) Software versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0
Disclosure Date:	July 29, 2026
Patch Status:	Hot fixes available; CISA KEV mandates federal patch by August 1, 2026

References

1. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” July 29, 2026, https://www.cisa.gov/news-events/alerts/2026/07/29/cisa-adds-one-known-exploited-vulnerability-catalog (accessed July 30, 2026).
2. Cisco Security Advisory, “Cisco Secure Firewall Management Center Static Credentials Vulnerability,” July 29, 2026, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh (accessed July 30, 2026).
3. The Hacker News, “Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data,” July 30, 2026, https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html (accessed July 30, 2026).