Full research report
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
Executive assessment
CVE-2026-20316 is a textbook hardcoded-credential flaw (CWE-259) in Cisco Secure FMC, a high-value management-plane target that centralises control over enterprise firewall estates. The flaw requires no authentication and no user interaction, making it trivially reachable from any network path to the management interface regardless of firewall policy sophistication. Cisco's elevation from CVSS Medium to High severity acknowledges a realistic chaining risk against other unnamed FMC vulnerabilities, but without those CVEs being disclosed defenders cannot independently assess the full escalation path. The rapid progression from Cisco PSIRT awareness to simultaneous vendor advisory and CISA KEV listing on the same day suggests the vulnerability was weaponised in the wild before coordinated disclosure was complete, compressing the defender response window. The absence of actor attribution, undisclosed exploitation start date, and lack of a Horizon3.ai technical write-up are significant intelligence gaps that prevent contextualising how widely or how selectively this flaw has been exploited.
What happened
On 29 July 2026, Cisco published a security advisory for CVE-2026-20316, a hardcoded-credential vulnerability in Cisco Secure Firewall Management Center (FMC) Software, and confirmed that active exploitation had been detected by its Product Security Incident Response Team during July 2026. CISA simultaneously added the flaw to its Known Exploited Vulnerabilities catalogue, setting a federal remediation deadline of 1 August 2026. The vulnerability was reported by Jimi Sebree of Horizon3.ai, though that firm has not published a technical write-up. Cisco has not disclosed when exploitation began, which organisations were targeted, or who the threat actors are.
Affected scope
Cisco Secure FMC Software versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 on on-premises deployments. Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat defence Software, and Security Cloud Control are confirmed unaffected. FMC is a centralised management platform for Cisco Secure Firewall appliances; its compromise gives an attacker visibility into and control over a managed firewall estate.
Technical assessment
The vulnerability is classified CWE-259 (Use of Hard-coded Password). Static credentials for a built-in low-privilege account are embedded in the FMC software and cannot be changed or removed by administrators. An unauthenticated remote attacker with network access to the management interface can authenticate using these fixed credentials to retrieve sensitive configuration data. Cisco assigns a High severity rating despite the CVSS 5.3 base score because the initial access can be chained with other unspecified FMC vulnerabilities to escalate privileges; those secondary CVEs have not been publicly named, limiting independent assessment of the full escalation path.
Recommended defensive actions
- Apply Cisco-released hotfixes immediately: GB-7.0.9.1-3 for version 7.0, HL-7.2.11.1-4 for 7.2, HG-7.4.7.1-3 for 7.4, CY-7.6.5.1-2 for 7.6, AM-7.7.12.1-2 for 7.7, and P-10.0.1.1-2 for 10.0.
- Restrict network access to the FMC management interface to internal trusted management networks only; remove any direct internet exposure pending patching.
- Hunt for compromise by running `cat /var/log/messages | grep license` on each FMC and inspecting for entries referencing `/var/tmp/license.tmp` or `package_info.pl` execution.
- Rotate all user credentials, API keys, and certificates on affected FMC devices if any IoC is found or exploitation is suspected.
- Verify unaffected status of Cloud-Delivered FMC, ASA, and Threat defence Software deployments to prioritise on-premises FMC remediation effort.
Uncertainties and evidence gaps
- Cisco has not disclosed when exploitation began, which organisations were targeted, or what data was accessed; the full scope of in-the-wild impact is unknown.
- The specific additional FMC vulnerabilities that can be chained with CVE-2026-20316 for privilege escalation have not been publicly named; the actual escalation risk cannot be independently assessed.
- Horizon3.ai has not published a technical write-up; without it, exploitation complexity and prerequisites beyond network reachability remain unverified by independent analysis.
- No threat actor or campaign attribution has been made by any source; it is unknown whether exploitation is opportunistic or targeted.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in the wild as of July 2026; added to CISA KEV on 29 July 2026 with a federal remediation deadline of 1 August 2026. No public proof-of-concept exploit code has been confirmed.
The investigation began from the CISA KEV entry and press reporting confirming active exploitation of a Cisco FMC static credential flaw. Searches quickly surfaced multiple secondary sources and the official Cisco advisory URL; fetching the advisory directly provided authoritative technical detail including CWE classification, affected versions, exact hotfix identifiers, and IoC log patterns. Three independent news sources and the NVD entry corroborated the core findings. No public PoC was found, Horizon3.ai has not published a write-up, and no threat actor attribution has been made by any source.
- What is CVE-2026-20316 and what is the nature of the Cisco FMC vulnerability?Searched for CVE-2026-20316 Cisco FMC zero-day 2026 and for Cisco FMC static credentials CISA KEV 2026
Multiple independent secondary sources confirmed a hardcoded-credential flaw in Cisco Secure FMC Software enabling unauthenticated remote access, with active exploitation confirmed and CISA KEV listing on 29 July 2026 with an August 1 federal deadline.
why Established the event type and severity framing and provided leads for primary source URLs, including the Cisco advisory identifier.
- What are the full technical specifics, affected versions, and defensive indicators?Fetched Bleeping Computer coverage of the vulnerabilitybleepingcomputer.com ↗
Confirmed affected versions (7.0, 7.2, 7.4, 7.6, 7.7, 10.0), Jimi Sebree of Horizon3.ai as the reporter, IoC log path /var/tmp/license.tmp, and an associated CVSS 10.0 FMC flaw CVE-2026-20079 patched in the same releases.
why Bleeping Computer is a reliable secondary source; its detail on versions and IoCs narrowed defensive guidance and identified a related high-severity CVE relevant to chaining risk.
- What does the official Cisco advisory state on technical details and remediation?Fetched the Cisco Security Advisory directlysec.cloudapps.cisco.com ↗
Primary source confirmation of CVSS 5.3 with Cisco High rating, CWE-259 classification, exact hotfix build numbers per release, no available workaround, and Cisco PSIRT awareness of active exploitation in July 2026.
why The vendor advisory is the authoritative technical source and supersedes secondary reporting; exact hotfix identifiers are required for accurate defensive actions.
- Does the NVD independently confirm the CVE classification and CVSS vector?Fetched the NVD entry for CVE-2026-20316nvd.nist.gov ↗
Confirmed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3 Medium) and CWE-259, referencing the Cisco advisory as the primary source.
why Independent government database confirmation of the CVSS vector and CWE strengthens confidence in the technical classification and corroborates the vendor's own scoring.
- Has Horizon3.ai published a technical write-up or public PoC?Searched for Horizon3.ai research write-up and PoC for CVE-2026-20316
No Horizon3.ai publication found; multiple sources confirmed the researcher attribution but noted the firm had not yet released any write-up or exploit code.
why Absence of a Horizon3.ai write-up confirms no public PoC or independent technical analysis is available, which is a material gap affecting the exploitation complexity assessment.
- Does Help Net Security corroborate the IoC details and remediation steps independently?Fetched Help Net Security coveragehelpnetsecurity.com ↗
Confirmed IoC pattern (package_info.pl referencing /var/tmp/license.tmp), the August 1 FCEB deadline, and Cisco's guidance to rotate all credentials on affected devices if compromise is suspected.
why A third independent source corroborating the same IoC details increases confidence that the detection guidance is accurate and actionable for defenders.
- What are the precise CISA KEV listing details and is any attribution disclosed?Fetched SecurityAffairs article on the CISA KEV additionsecurityaffairs.com ↗
Confirmed KEV date of 29 July 2026, federal deadline of 1 August 2026 under Binding Operational Directive 22-01, and that Cisco has not disclosed attack onset date, actor identity, or targeted organisations.
why Established the precise regulatory timeline and confirmed the attribution gap as a material uncertainty, not a reporting omission.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (1 primary, 3 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1656 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| BleepingComputernews | ok10 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| NVDcve | ok900 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| FIRST EPSSepss | ok7136 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok667 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1006 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok11 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 4 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories1
Primary vendor advisory confirming exploitation, exact hotfix build numbers, IoC log path, no-workaround status, and CWE-259 classification.
Analysis & research4
Detailed independent coverage identifying the Horizon3.ai researcher, IoC log path, and a related CVSS 10.0 FMC flaw patched in the same releases.
Independent corroboration of the Cisco advisory URL, severity rationale, and CISA KEV remediation deadline.
Third independent source confirming the package_info.pl IoC indicator and credential-rotation remediation guidance.
Government database confirming CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N and CWE-259 classification.