Cisco: Embedded Credentials in Secure FMC Used in Zero-Day Attacks

Cisco has reported the active exploitation of a high-severity vulnerability in Secure Firewall Management Center (FMC). The flaw, assigned the identifier CVE-2026-20316, involves the static credentials of a low-privileged account embedded directly into the Secure FMC software.

According to Cisco, an unauthenticated remote attacker can use these credentials to log in and gain access to the sensitive information available to this account. Formally, the vulnerability received a score of only 5.3 on the CVSS scale, yet the company rated it High: the access obtained can be chained with other FMC vulnerabilities to escalate privileges. Cisco has not yet disclosed exactly which flaws are used in the chain, or how.

The issue affects Secure FMC Software regardless of the device configuration, but it does not affect the cloud variant Cloud-Delivered FMC, Firewall Device Manager, or ASA, Threat Defense and Security Cloud Control. Hot fixes have been released for the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 branches. No workarounds exist, so Cisco strongly recommends installing the updates. The company was notified of the vulnerability by Jimi Sebree of Horizon3.ai.

How to Check for Compromise

Cisco learned of the exploitation in July 2026, but who is behind the attacks, when they began and which organizations were affected has not been disclosed. The risk is reduced if the FMC management interface is not exposed to the internet.

To detect signs of a breach, administrators are advised to examine the /var/log/messages file. In expert mode, the command cat /var/log/messages | grep license can be run. A sign of compromise is an entry in which the FMC web process running under the www account launches the package_info.pl script as root with the file /var/tmp/license.tmp. If this indicator is found, all credentials, keys and certificates on the device should be changed and Cisco TAC should be contacted.

And One More Flaw Rated 10 Out of 10

In parallel, Cisco updated its advisory on another, critical FMC vulnerability — CVE-2026-20079 with the maximum CVSS score of 10.0. It allows an unauthenticated attacker to bypass authentication and execute commands with root privileges by sending specially crafted HTTP requests; the cause is a system process that is incorrectly created during startup. Unlike the first flaw, this one requires no credentials or prior access.

Interestingly, both advisories feature the same indicator, /var/tmp/license.tmp, yet Cisco does not explain whether the vulnerabilities are related. The company is not yet aware of any real-world exploitation of CVE-2026-20079; this flaw was first disclosed back in March 2026, and on July 29 a second identifier, patches and indicators of compromise were added to it. The same fixes have been released for both issues.

Source: Bleeping Computer