CVE-2026-20316

What is Cisco Secure Firewall Management Center?

Cisco Secure Firewall Management Center (FMC), formerly Firepower Management Center, is the centralized management console for Cisco's firewall estate — Secure Firewall Threat Defense (FTD), Firepower appliances, and ASA with FirePOWER services. FMC is where access control policies, Snort-based intrusion prevention rules, NAT, VPN configuration, TLS decryption policy, and identity integration are authored and pushed out to managed devices, and where all event, connection, and IPS telemetry is aggregated for analysis. It ships as a hardware appliance (the FMC 1600/2600/4600 class) or as a virtual appliance (FMCv) on ESXi, KVM, AWS, and Azure.

FMC is the policy authority for the perimeter, which is what makes it a high-value target. Privileged access to FMC means the ability to rewrite firewall rules across every managed device, disable or blind IPS inspection, harvest decrypted-traffic material and the aggregated event database, and pivot into managed FTD appliances — a single point of total network security control.

Not affected: Cloud-Delivered FMC, Secure Firewall Device Manager (FDM), Secure Firewall ASA Software, and Secure Firewall Threat Defense Software.

Overview

The web interface of Cisco Secure FMC Software contains static user credentials for a low-privileged account. An unauthenticated, remote attacker can use those credentials to log in to an affected system and access sensitive data available to that account. The flaw affects FMC regardless of device configuration — there is no setting that disables it.

Cisco published the advisory and hotfixes on 2026-07-29, stating that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CISA added it to the KEV catalog the same day with a three-day remediation deadline.

The most important framing point for this CVE is the gap between its scores. The CVSS base score is only 5.3 (MEDIUM) — the account is low-privileged and read-only in effect. But Cisco assigned a Security Impact Rating of High, deliberately above the CVSS score, because "an attacker could leverage this vulnerability in conjunction with other vulnerabilities in Cisco Secure FMC to elevate privileges." CVSS scores the primitive in isolation; the SIR reflects what the primitive is actually worth — a reliable, unauthenticated foothold on a firewall management plane, from which known privilege escalation paths exist.

Affected Versions

Cisco shipped hotfixes rather than full maintenance releases. Apply the hotfix matching your release train:

Cloud-Delivered FMC, FDM, Secure Firewall ASA Software, and Secure Firewall Threat Defense Software are not affected.

Technical Details

CWE-259 — Use of Hard-Coded Password. Credentials for a low-privileged account are embedded in the FMC web application itself. There is nothing for an attacker to defeat: possession of the credential is the exploit.

Attack characteristics:

• Authentication: none required. The static credentials substitute for authentication. Network reachability to the FMC web interface is the only prerequisite.
• Complexity: low, no user interaction, single authentication request. This is maximally automatable — a static credential can be sprayed across every discovered FMC instance at scan speed, with no per-target adaptation.
• Impact: C:L / I:N / A:N, Scope Unchanged, which produces the modest 5.3 base score. The account is low-privileged and grants read access to data visible to it, not administrative control.
• Value is in chaining, not in the primitive. Cisco is explicit that the access can be combined with other FMC vulnerabilities to escalate privileges. That is why the vendor's Security Impact Rating (High) diverges from the CVSS score (Medium).
• No workarounds exist. Cisco states this plainly — the credential is compiled into the software, so only the hotfix removes it.

Cisco has not disclosed the account name, the password, or how the credential is stored or derived.

Discovery

Reported by Jimi Sebree of Horizon3.ai, credited in the acknowledgement section of Cisco's advisory: "Cisco would like to thank Jimi Sebree of Horizon3.ai for reporting this vulnerability." Horizon3.ai had not published a technical write-up at the time of writing.

The sequencing is worth noting: the vulnerability was reported by an external researcher, but Cisco PSIRT separately became aware of active exploitation in July 2026. The researcher report and the in-the-wild discovery appear to have converged, making this a zero-day at the point of disclosure.

Exploitation Context

Confirmed exploited as a zero-day. Cisco's advisory states that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Advisory and hotfixes were published 2026-07-29, with the CISA KEV addition the same day.

Cisco has not disclosed when attacks began, who is behind them, or which organizations were targeted. No threat actor has been named, and no Shodan, Censys, Shadowserver, or runZero exposure counts have been published for internet-facing FMC instances in connection with this CVE.

The chaining picture is where this gets interesting. Two related FMC flaws, both patched in March 2026, are relevant:

• CVE-2026-20079 — a critical FMC authentication bypass (reported at CVSS 10.0) enabling arbitrary script execution and root-level OS access. Cisco published updated indicators of compromise for CVE-2026-20079 at the same time as this advisory, and the two advisories share the same IOC, which strongly suggests the observed attacks touch both. Cisco declined to clarify the relationship. One caveat from BleepingComputer's reporting: Cisco's description of CVE-2026-20079 indicates it can be exploited without the static credentials, so the two are not strictly dependent on one another. Cisco has not confirmed in-the-wild exploitation of CVE-2026-20079.
• CVE-2026-20131 — FMC remote code execution via crafted Java serialization objects. Per Help Net Security, the Interlock ransomware group began exploiting it as a zero-day on 2026-01-26.

The Interlock link should be read as adjacent context, not as attribution for CVE-2026-20316 — no source ties Interlock to this specific CVE. What it does establish is that Cisco FMC has been under sustained attack by a ransomware operator through the first half of 2026, and that a fresh unauthenticated foothold on that same management plane is worth considerably more than 5.3 suggests.

On the three-day deadline. KEV addition 2026-07-29, deadline 2026-08-01 — the most aggressive BOD 26-04 tier, despite a MEDIUM base score. Under BOD 26-04, deadlines are scored on asset exposure, KEV status, exploit automation, and post-exploitation impact rather than on CVSS alone. A static credential against an exposed management plane scores at the top on exposure and automation. This CVE and the CVSS 10.0 CVE-2026-16812 drawing the same three-day deadline, while the CVSS 5.9 CVE-2025-68686 drew fourteen days, is a concrete demonstration that federal urgency has been decoupled from CVSS scoring.

Remediation

1. Apply the hotfix for your release train — GB-7.0.9.1-3, HL-7.2.11.1-4, HG-7.4.7.1-3, CY-7.6.5.1-2, AM-7.7.12.1-2, or P-10.0.1.1-2. There is no workaround; the credential is in the software and only the hotfix removes it.

2. Remove the FMC web interface from the internet. FMC is a management plane and has no business being publicly reachable. Restrict it to a management VLAN, a jump host, or VPN access with source-IP allowlisting. This is the highest-leverage compensating control while hotfixes are being staged.

3. Hunt for Cisco's published indicator of compromise. From expert mode, run:

   zgrep "package_info.*license" messages*
   

   against /var/log/messages and its rotated archives. Per Cisco: if the log message in the output includes /var/tmp/license.tmp, this vulnerability may have been exploited.

4. Note the shared indicator with CVE-2026-20079. The same IOC appears in Cisco's updated advisory for that flaw, so a hit does not by itself tell you which vulnerability was used. Confirm both are patched before concluding the investigation.

5. If exploitation is suspected, Cisco directs customers to rotate all user credentials, keys, and certificates on the Secure FMC device, and to contact Cisco TAC. Given FMC's role, extend that rotation to everything FMC held — managed-device registration keys, RADIUS/LDAP bind credentials, SNMP community strings, API tokens, and any TLS decryption keys.

6. Review policy and configuration state across all managed FTD devices for unauthorized access-control rule changes, disabled IPS policies, added administrator accounts, or altered TLS decryption settings. Diff against a known-good configuration backup rather than reviewing by inspection.