CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-20316; Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms exploitation has been ongoing

cve · CVE-2026-20316 single-source

Coverage
1
first 2026-07-30 → last 2026-09-30
Latest activity
2026-09-29
Cisco patches an actively exploited hardcoded credential in Secure FMC: CVSS 5.3, but Cisco rates the…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, energy, telco
Sources cited
2
2 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-20316, newest first. Check the date before acting on an older one.

  • Upgrade every on-premises Secure FMC on 7.0 and earlier, 7.2, 7.4, 7.6, 7.7 and 10.0 to its hardening release (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 or 10.0.2), including any already carrying the earlier hot fix; Cisco states no workaround exists, so restricting reachability is a containment step and not a substitute.
    2026-07-30CVE-2026-20316
  • On every FMC whose web interface has been reachable, run Cisco's check in expert mode (zgrep "package_info.license" over /var/log/messages, a hit naming /var/tmp/license.tmp indicates possible exploitation) and treat a hit as a compromise to work with Cisco TAC, since Cisco states its hot fixes may not address an existing compromise.
    2026-07-30CVE-2026-20316

Defender insights

What each entry about CVE-2026-20316 tells a defender to do, newest first.

2026-07-30HIGHexploitedCisco patches an actively exploited hardcoded credential in Secure FMC: CVSS 5.3, but Cisco rates the advisory High for privilege-escalation chaining

Detection

Story timeline

  1. 2026-07-30CVE-2026-20316: Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms active exploitation
    trending-vulnerabilitiesCisco patches an actively exploited hardcoded credential in Secure FMC: CVSS 5.3, but Cisco rates the advisory High for privilege-escalation chaining

Hunting pivots

Affected products
Cisco Secure Firewall Management Center
Tags
actively-exploitedauth-bypasscisa-kevdefault-configpatch-availablepre-authransomwarevulnerabilities
ATT&CK techniques (2 across 4 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Default Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts: Default Accounts
  • Privilege EscalationValid Accounts: Default Accounts
  • StealthValid Accounts: Default Accounts

Initial Access TA0001

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-30/cisco-secure-fmc-cve-2026-20316-static-credential-exploited · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-30/cisco-secure-fmc-cve-2026-20316-static-credential-exploited · ATT&CK page ↗

Persistence TA0003

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-30/cisco-secure-fmc-cve-2026-20316-static-credential-exploited · ATT&CK page ↗

Privilege Escalation TA0004

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-30/cisco-secure-fmc-cve-2026-20316-static-credential-exploited · ATT&CK page ↗

Stealth TA0005

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-07-30/cisco-secure-fmc-cve-2026-20316-static-credential-exploited · ATT&CK page ↗

Entries about CVE-2026-20316; Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms exploitation has been ongoing (1)

2026-07-30 · view entry permalink →

HIGHCVE-2026-20316exploitedupdatedNATOA2

CVE-2026-20316: Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms active exploitation

Cisco Secure Firewall Management Center is the management server for a Cisco firewall estate. CVE-2026-20316 places a vendor-embedded static password for a low-privileged account inside that server's web interface: Cisco states the flaw "is due to the presence of static user credentials for a low-privileged account" and that "an attacker could exploit this vulnerability by using the account to log in to an affected system" (Cisco PSIRT, 2026-07-29). Because the credential ships with the software, there is no attacker-side prerequisite beyond reaching the interface: the account exists on every affected release, so an attacker needs a network path and nothing else.

The exploitation status is what moves this out of the routine patch cycle. Cisco PSIRT states that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability" (Cisco PSIRT, 2026-07-29). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-07-29 (CISA KEV catalog, 2026-07-29).

Read the score and the rating together rather than separately. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) because the exposed account is low-privileged and the direct impact is confidentiality-only, but Cisco overrode that judgement in its own advisory: "Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco PSIRT, 2026-07-29). Treating this as a medium-severity information disclosure and scheduling it accordingly is the wrong read: it is a pre-authenticated foothold on a security-management server, and its value to an attacker is as the first link in a chain.

Affected releases are 7.0 and earlier, 7.2, 7.4, 7.6, 7.7 and 10.0, regardless of how the device is configured, with 7.0.10 as the fix for 7.0 and earlier (Cisco PSIRT, revised 2026-09-16), and Cisco explicitly states no workaround exists (Cisco PSIRT, 2026-07-29). Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA, Secure Firewall Threat Defense and Security Cloud Control are listed as not affected (Cisco PSIRT, 2026-07-29), so the exposure is specifically the on-premises management centre.

In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system.

Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

If exploitation is suspected, immediately contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. The hot fix files listed in this advisory are for preventing future exploitation only and may not address existing compromise. Follow all Cisco TAC guidance if indicators of compromise are present.

Previously, hot fixes were provided to remediate this vulnerability. At the time of this update, the hardening releases in the preceding tables have been published and include the fix for this vulnerability as well as multiple other internally discovered vulnerabilities.

Cisco PSIRT 2026-07-29
Updaterun 2026-09-29T2134Z-audittitlesummarycvesevidenceactionssourcing_notebody

Cisco has revised the advisory six times since 29 July, and two changes alter what a defender does. First, the fix: the per-train hot fixes are replaced by hardening releases, 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 and 10.0.2, with 10.1.0 also listed. Cisco says "Previously, hot fixes were provided to remediate this vulnerability. At the time of this update, the hardening releases in the preceding tables have been published and include the fix for this vulnerability as well as multiple other internally discovered vulnerabilities" (Cisco PSIRT, revised 2026-09-16). Second, the compromise guidance: the advisory no longer tells customers to rotate every credential, key and certificate on the device. It now reads "If exploitation is suspected, immediately contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. The hot fix files listed in this advisory are for preventing future exploitation only and may not address existing compromise." Cisco's check is a search in expert mode of the system messages logs for package_info entries naming /var/tmp/license.tmp. Cisco also now credits Jimi Sebree of Horizon3.ai and Andy Niu of TrendAI Research with reporting the flaw.

Correctionrun 2026-09-30T0639Z-audittagssourcessourcing_notebodytitleheadlinesummarycvesactions

CISA's Known Exploited Vulnerabilities catalog marks CVE-2026-20316 as used in known ransomware campaigns (CISA KEV catalog, 2026-07-29). Cisco's fixed-release table, added in the advisory's revision of 2026-09-16, lists 7.0 and earlier as affected, with 7.0.10 as the fix, so releases older than 7.0 are in scope too (Cisco PSIRT, 2026-07-29). Cisco does not name the static account or say it has no legitimate use, so a login under it is not a discriminator the advisory supports. The check Cisco publishes is the log search for package_info entries naming /var/tmp/license.tmp, and revisions since first publication send any device with indicators to TAC because its hot fix files may not address an existing compromise (Cisco PSIRT, 2026-07-29).

vulnerability30 Jul 04:52Zsingle-sourceOpen finding →
Sources: Cisco PSIRT · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (50%)
  • sec.cloudapps.cisco.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)