CVE-2026-20316: Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms active exploitation
Cisco patches an actively exploited hardcoded credential in Secure FMC: CVSS 5.3, but Cisco rates the advisory High for privilege-escalation chaining
Defender actions
- Upgrade every on-premises Secure FMC on 7.0 and earlier, 7.2, 7.4, 7.6, 7.7 and 10.0 to its hardening release (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 or 10.0.2), including any already carrying the earlier hot fix; Cisco states no workaround exists, so restricting reachability is a containment step and not a substitute.
- On every FMC whose web interface has been reachable, run Cisco's check in expert mode (zgrep "package_info.license" over /var/log/messages, a hit naming /var/tmp/license.tmp indicates possible exploitation) and treat a hit as a compromise to work with Cisco TAC, since Cisco states its hot fixes may not address an existing compromise.
Analysis
Cisco Secure Firewall Management Center is the management server for a Cisco firewall estate. CVE-2026-20316 places a vendor-embedded static password for a low-privileged account inside that server's web interface: Cisco states the flaw "is due to the presence of static user credentials for a low-privileged account" and that "an attacker could exploit this vulnerability by using the account to log in to an affected system" (Cisco PSIRT, 2026-07-29). Because the credential ships with the software, there is no attacker-side prerequisite beyond reaching the interface: the account exists on every affected release, so an attacker needs a network path and nothing else.
The exploitation status is what moves this out of the routine patch cycle. Cisco PSIRT states that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability" (Cisco PSIRT, 2026-07-29). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-07-29 (CISA KEV catalog, 2026-07-29).
Read the score and the rating together rather than separately. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) because the exposed account is low-privileged and the direct impact is confidentiality-only, but Cisco overrode that judgement in its own advisory: "Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco PSIRT, 2026-07-29). Treating this as a medium-severity information disclosure and scheduling it accordingly is the wrong read: it is a pre-authenticated foothold on a security-management server, and its value to an attacker is as the first link in a chain.
Affected releases are 7.0 and earlier, 7.2, 7.4, 7.6, 7.7 and 10.0, regardless of how the device is configured, with 7.0.10 as the fix for 7.0 and earlier (Cisco PSIRT, revised 2026-09-16), and Cisco explicitly states no workaround exists (Cisco PSIRT, 2026-07-29). Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA, Secure Firewall Threat Defense and Security Cloud Control are listed as not affected (Cisco PSIRT, 2026-07-29), so the exposure is specifically the on-premises management centre.
Cited evidence
In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
If exploitation is suspected, immediately contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. The hot fix files listed in this advisory are for preventing future exploitation only and may not address existing compromise. Follow all Cisco TAC guidance if indicators of compromise are present.
Previously, hot fixes were provided to remediate this vulnerability. At the time of this update, the hardening releases in the preceding tables have been published and include the fix for this vulnerability as well as multiple other internally discovered vulnerabilities.
Updates2
Cisco has revised the advisory six times since 29 July, and two changes alter what a defender does. First, the fix: the per-train hot fixes are replaced by hardening releases, 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 and 10.0.2, with 10.1.0 also listed. Cisco says "Previously, hot fixes were provided to remediate this vulnerability. At the time of this update, the hardening releases in the preceding tables have been published and include the fix for this vulnerability as well as multiple other internally discovered vulnerabilities" (Cisco PSIRT, revised 2026-09-16). Second, the compromise guidance: the advisory no longer tells customers to rotate every credential, key and certificate on the device. It now reads "If exploitation is suspected, immediately contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. The hot fix files listed in this advisory are for preventing future exploitation only and may not address existing compromise." Cisco's check is a search in expert mode of the system messages logs for package_info entries naming /var/tmp/license.tmp. Cisco also now credits Jimi Sebree of Horizon3.ai and Andy Niu of TrendAI Research with reporting the flaw.
CISA's Known Exploited Vulnerabilities catalog marks CVE-2026-20316 as used in known ransomware campaigns (CISA KEV catalog, 2026-07-29). Cisco's fixed-release table, added in the advisory's revision of 2026-09-16, lists 7.0 and earlier as affected, with 7.0.10 as the fix, so releases older than 7.0 are in scope too (Cisco PSIRT, 2026-07-29). Cisco does not name the static account or say it has no legitimate use, so a login under it is not a discriminator the advisory supports. The check Cisco publishes is the log search for package_info entries naming /var/tmp/license.tmp, and revisions since first publication send any device with indicators to TAC because its hot fix files may not address an existing compromise (Cisco PSIRT, 2026-07-29).
Sources2
Revision history
- Published 2026-07-30T0409Z-intel
- Update 2026-09-29T2134Z-audit
Cisco revised the advisory six times after publication. Hardening releases 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 and 10.0.2 now replace the per-train hot fixes (v1.6, 2026-09-16). The compromise guidance changed too: the recommendation to rotate every credential, key and certificate is gone, and Cisco now says to contact TAC if exploitation is suspected, warning that the fix does not address an existing compromise. Its log check for a license.tmp artifact is given in full. The summary, actions and analysis follow the current advisory. The sourcing note dates the KEV check to publication.
Changed: title summary cves evidence actions sourcing_note body
- Correction 2026-09-30T0639Z-audit
Adds that CISA's KEV catalog marks CVE-2026-20316 as used in known ransomware campaigns. Cisco's fixed-release table covers 7.0 and earlier, not only 7.0, and the detection and triage text claimed that any login under the static account has no legitimate use, which Cisco does not say. Detection now leads with Cisco's log check and the unsupported triage line is removed. The sourcing note is rewritten, and the US federal deadline is gone. Hot-fix file names the current advisory no longer lists are dropped, Cisco's warning about existing compromise is attributed to its hot fix files, and an uncited statement that the server holds credentials for every managed device is removed.
Changed: tags sources sourcing_note body title headline summary cves actions
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.