Full research report
Cisco warns of FMC static credential flaw exploited in zero-day attacks
Executive assessment
The central event is confirmed exploitation of CVE-2026-20316, not a general campaign involving every FMC vulnerability patched on 29 July. Its immediate consequence is low-privilege access through static credentials, but Cisco considers it High severity because undisclosed companion flaws can elevate that access. CVE-2026-20079 is more severe in isolation and shares Cisco's published indicator and hot fixes, yet the vendor expressly reports no known malicious use, so linking it to the observed attacks would exceed the evidence. Defenders therefore need both rapid patching and compromise assessment, particularly where FMC management interfaces were internet-accessible.
What happened
Cisco disclosed CVE-2026-20316 on 29 July 2026 after becoming aware during July of active exploitation against Secure Firewall Management Center (FMC) Software. The flaw exposes static credentials for a built-in low-privilege account; CISA added it to the Known Exploited Vulnerabilities catalogue on the same day. Cisco also updated its March 2026 advisory for the separate CVE-2026-20079 authentication bypass with hot fixes and an indicator of compromise, while stating that it knows of no malicious use of that vulnerability.
Affected scope
CVE-2026-20316 affects Cisco Secure FMC Software regardless of configuration, including supported 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 release branches for which Cisco supplied hot fixes. Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat defence Software and Security Cloud Control are not affected by CVE-2026-20316. CVE-2026-20079 separately affects Secure FMC Software and Cisco Security Cloud Control Firewall Management; Cisco states that it has already fixed the latter software-as-a-service environment.
Technical assessment
CVE-2026-20316 places static credentials for a low-privilege account in the FMC web interface, allowing an unauthenticated remote party that possesses those credentials to access sensitive data. Cisco rates the issue High despite its 5.3 CVSS score because the resulting foothold can be combined with other, unspecified FMC vulnerabilities to elevate privileges. CVE-2026-20079 is a distinct authentication-boundary failure caused by an improper process created at boot, permitting crafted web requests to reach root-level script and command execution without credentials. Both advisories identify an invocation of Cisco's package-information utility by the web account against /var/tmp/license.tmp as possible evidence of compromise, but Cisco has not explained whether that shared indicator establishes a connection between the flaws.
Recommended defensive actions
- Immediately apply Cisco's corresponding FMC hot fix for release branches 7.0, 7.2, 7.4, 7.6, 7.7 or 10.0; no workaround fully addresses either vulnerability.
- Restrict FMC management interfaces to trusted administrative networks and remove direct public-internet exposure.
- Hunt in /var/log/messages for activity involving /var/tmp/license.tmp and for the FMC web account invoking package_info.pl with elevated privileges.
- Investigate any matching indicator with Cisco Technical Assistance Center and preserve relevant FMC logs and forensic evidence before recovery.
- Rotate all FMC user credentials, keys and certificates when exploitation is suspected or the documented indicator is present.
- Inventory every on-premises FMC deployment and verify its installed release and hot-fix status against Cisco's advisory or Software Checker.
Uncertainties and evidence gaps
- Cisco has not identified the actor, victims, targeted sectors, initial exploitation date or scale of the CVE-2026-20316 activity.
- Cisco has not disclosed the additional FMC vulnerabilities reportedly used with CVE-2026-20316 for privilege elevation.
- The reason both advisories contain the same /var/tmp/license.tmp indicator is not explained, so evidence does not establish that CVE-2026-20079 participated in the observed attacks.
- No public proof-of-concept was found in the repositories checked, but absence from those locations does not prove that private exploit code is unavailable.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
CVE-2026-20316 is subject to confirmed active exploitation; Cisco reports no known malicious use of CVE-2026-20079, and no public proof-of-concept was identified for either flaw.
The investigation separated the actively exploited static-credential flaw from the older authentication bypass discussed alongside it. Cisco and CISA independently establish exploitation of CVE-2026-20316, while Cisco explicitly denies knowledge of malicious use of CVE-2026-20079. Review of NVD records and public exploit repositories supported the product and technical assessment but found no public proof-of-concept or evidence identifying an actor or campaign.
- Is exploitation of CVE-2026-20316 independently confirmed?Reviewed the CISA Known Exploited Vulnerabilities catalogue entry.cisa.gov ↗
CISA lists CVE-2026-20316 as a hard-coded-password vulnerability exploited in the wild, added on 29 July 2026 with a 1 August 2026 due date.
why This government record independently confirms exploitation and raises remediation priority beyond what the severity score alone suggests.
- What access and impact does CVE-2026-20316 provide?Reviewed the National Vulnerability Database record.nvd.nist.gov ↗
The flaw is remotely accessible without prior authentication and provides low-privilege access to sensitive information through static credentials; NVD also records its KEV status.
why This establishes the security boundary crossed and prevents overstating the vulnerability itself as direct root compromise.
- Is CVE-2026-20079 technically related to the reported FMC event?Reviewed the National Vulnerability Database record for the second CVE.nvd.nist.gov ↗
CVE-2026-20079 is a separate CVSS 10.0 authentication bypass in the FMC web interface that can yield root access through an improper boot-time process.
why The record confirms product overlap but a materially different mechanism and impact, requiring separate exploitation language.
- What does Cisco confirm about scope, exploitation, fixes and detection for CVE-2026-20316?Read Cisco's complete static-credential advisory.sec.cloudapps.cisco.com ↗
Cisco confirms active exploitation in July 2026, all-configuration exposure for Secure FMC, no workaround, hot fixes for six maintained release branches and a /var/tmp/license.tmp log indicator.
why The vendor advisory supplies the authoritative affected-product boundaries, remediation details and operational hunting hook.
- Was CVE-2026-20079 also exploited, and why was it included in the reporting?Read Cisco's updated authentication-bypass advisory.sec.cloudapps.cisco.com ↗
Cisco added hot fixes and the same indicator on 29 July but states that it is unaware of malicious use of CVE-2026-20079.
why This contradicts any inference that the shared indicator proves both flaws were exploited and confines confirmed active exploitation to CVE-2026-20316.
- Did the reporting researcher publish technical analysis or exploit code?Searched Horizon3.ai's public site for the CVE identifier.horizon3.ai ↗
The site returned no matching publication, although Cisco credits Horizon3.ai researcher Jimi Sebree with reporting the vulnerability.
why This leaves the discovery attribution confirmed by Cisco but provides no public technical write-up or proof-of-concept to cite.
- Is public exploit code indexed by a specialist exploit archive?Searched Exploit Database by CVE identifier.exploit-db.com ↗
The search returned no entries for CVE-2026-20316.
why This supports a cautious assessment that no public proof-of-concept was identified, without claiming that private code does not exist.
- Is a dedicated public repository available for CVE-2026-20316?Searched GitHub repositories for the exact CVE identifier.github.com ↗
GitHub returned no matching repositories.
why Together with the specialist archive and researcher-site checks, this provides no evidence of publicly released exploit code at the time of review.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok9 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA KEVkev | ok1656 records | Primary evidence2 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| NVDcve | ok900 records | Corroborating2 matched items | Supplied independent analysis opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok667 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 13 opened outside the registered collection
Vulnerability & exploitation1
Vendor & gov advisories3
Cisco confirms active exploitation of CVE-2026-20316, provides hot fixes and documents a host-log indicator.
CISA added CVE-2026-20316 on 29 July 2026 and set a 1 August 2026 remediation deadline for affected federal systems.
Cisco's updated CVE-2026-20079 advisory provides the same hot fixes and indicator but states that malicious use is not known.
Analysis & research2
NVD corroborates the remotely accessible hard-coded credential weakness, CVSS 5.3 assessment and CISA KEV status.
NVD records the separate unauthenticated FMC authentication bypass as CVSS 10.0 and capable of yielding root access.