CVE-2026-20316: Cisco Secure Firewall Management Center Hardcoded Password Exploited in the Wild

CVE-2026-20316 is a hardcoded low-privilege password in Cisco Secure Firewall Management Center (FMC) that lets unauthenticated attackers log in and read sensitive configuration data. CISA added it to KEV on July 29 with a federal patch deadline of August 1.

Cisco and CISA disclosed CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC) on July 29, 2026: a hardcoded low-privilege account that unauthenticated remote attackers can use to log in and read sensitive data. CISA added it to KEV the same day, with an August 1 federal patch deadline.

Incident Overview

On July 29, 2026, Cisco and CISA jointly disclosed and responded to a vulnerability in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20316. The issue is a hardcoded low-privilege account credential in the software. Any remote unauthenticated attacker who knows that credential can log in to FMC and access sensitive data on the system.

CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog the same day and set an August 1 mandatory patch deadline for Federal Civilian Executive Branch agencies—three days from disclosure to due date. Cisco rated it High (despite a CVSS v3.1 base score of only 5.3) because it can be chained with other FMC flaws to reach higher privileges.

Technical Details

Vulnerability Basics

CVE ID CVE-2026-20316

CVSS v3.1 5.3 (Medium), Cisco rating High

Vulnerability type CWE-259: Use of Hard-coded Password

Attack vector Network, unauthenticated, no user interaction

Attacker privileges Built-in low-privilege account after login

Affected component Cisco Secure FMC (formerly Firepower Management Center) on-premises

Root Cause

Root cause is a leftover static credential from development: FMC embeds a low-privilege account whose username and password are identical on every affected install and cannot be changed or removed via any admin configuration. An attacker only needs to submit that hardcoded credential on the web login page to authenticate as the built-in account.

The built-in account itself has low privileges. Real severity is chaining:

• As an initial access primitive, it can read sensitive configuration data on FMC

• Combined with other FMC vulnerabilities for privilege escalation, ultimately controlling the entire firewall management plane

• As a control-plane foothold, it can affect every firewall device managed by that FMC

Cisco did not publish the hardcoded credential values, to avoid further lowering the attack barrier.

Affected Products

The vulnerability affects all on-premises Cisco Secure FMC versions, including:

• Cisco Secure FMC Software Release 7.0

• Cisco Secure FMC Software Release 7.2

• Cisco Secure FMC Software Release 7.4

• Cisco Secure FMC Software Release 7.6

Products explicitly not affected include Cloud-Delivered FMC (cdFMC), Firewall Device Manager (FDM), Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Security Cloud Control.

Indicators of Compromise (IoC)

Cisco provided a detection command. On FMC in expert mode, run:

cat /var/log/messages | grep license

If the output contains the `/var/tmp/license.tmp` path, for example:

sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

the FMC may have been exploited via this vulnerability.

Impact Assessment

• Exploitable by default: the hardcoded credential cannot be cleared or changed by an administrator; once obtained, access is durable

• Exploited in the wild: CISA states there is evidence of active exploitation

• CVSS is misleading: the 5.3 base score reflects standalone impact only; chained exploitation risk is much higher

• Federal KEV deadline is imminent: August 1 is the compliance cutoff; enterprise patch windows are days, not weeks

• Control plane is a high-value target: FMC is the core of Cisco firewall policy distribution; compromise means firewall policy can be altered at scale

Remediation

Apply Hotfixes Immediately

Cisco released hotfixes for each FMC version:

FMC Version Hotfix File

7.0 Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar

7.2 Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar

7.4 Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar

7.6 Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar

Download these hotfixes from the Software Center on Cisco.com.

Incident Response Steps

• Apply the hotfix urgently: download and install the file matching your version in the table above

• Rotate all credentials: given ongoing exploitation, Cisco strongly recommends immediately rotating all user credentials, keys, and certificates on FMC

• Review authentication logs: use the IoC command above to check for anomalous activity, focusing on unknown logins on or after July 23

• Audit policy changes: review all unauthorized policy changes, rule modifications, or new object creation

• Restrict the management network: confine the FMC management interface to a trusted management network; block direct internet access

• Contact TAC: if exploitation is confirmed, contact Cisco Technical Assistance Center for recovery assistance

Defense in Depth

• Place the firewall management console behind a zero-trust network boundary

• Enforce MFA and role-based fine-grained access control on the management interface

• Establish firewall policy-change audit and alerting

• Regularly review vendor security advisories and treat CISA KEV catalog changes as emergency patch triggers

References

• Cisco Security Advisory: Cisco Secure FMC Hardcoded Credential Vulnerability

• CISA: CVE-2026-20316 KEV Catalog Addition

• NVD: CVE-2026-20316 Details

• IntelFusions: CISA Warns of Abuse of Built-in Password in Cisco Firewall Management