Emerging Threats

Cisco FMC Zero-Day Exploited with Static Credentials

Analyst 207||Source: TheHackerNews
Cisco Secure Firewall Management Center device on a rack in a network operations center corridor.

"This vulnerability is due to the presence of static user credentials for a low-privileged account," Cisco said in an alert released Wednesday.

CVE-2026-20316: static credentials permit unauthenticated logins

The newly disclosed flaw, tracked as CVE-2026-20316 and carrying a CVSS score of 5.3, affects Cisco Secure Firewall Management Center (FMC) Software. Cisco said the vulnerability "could permit an unauthenticated, remote attacker to log in to an affected device using a low-privilege account to access sensitive data within susceptible systems." The company assigned the issue a Security Impact Rating (SIR) of High rather than Medium because it can be chained with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

CISA adds the bug to Known Exploited Vulnerabilities after reports of zero-day activity

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog following reports that the flaw was being used in the wild as a zero-day. Cisco acknowledged that the vulnerability became actively exploited earlier this month but did not disclose when the attacks began, who is behind them, or how the vulnerability is being exploited.

Indicators of compromise and a specific detection command

Cisco published an indicator-of-compromise (IoC) and a simple expert-mode command customers can run to look for signs of exploitation. The vendor urged customers to run:

cat /var/log/messages | grep license

If the command output includes the path "/var/tmp/license.tmp," Cisco warned there is a possibility the vulnerability may have been exploited on the Cisco Secure FMC device. In its advisory Cisco provided the following example log line:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

Hot fixes released for supported FMC versions

Cisco released hot fixes addressing CVE-2026-20316. The following hot fix packages were listed by Cisco as addressing the issue:

  • 7.0 - Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
  • 7.2 - Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
  • 7.4 - Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
  • 7.6 - Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
  • 7.7 - Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
  • 10.0 - Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

CVE-2026-20079: a related critical bypass and chaining concerns

Cisco also updated its advisory for CVE-2026-20079, a separate critical authentication bypass flaw with a CVSS score of 10.0, to include a second bug ID—"CSCwt95974"—the same indicators of compromise, and hot fixes. Cisco said it is not aware of malicious exploitation of CVE-2026-20079. However, because CVE-2026-20079 enables "the execution of arbitrary executable script files to obtain root access," Cisco noted that the inclusion of the same /var/tmp/license.tmp indicator suggests that threat actors could possibly chain CVE-2026-20316 with CVE-2026-20079 to achieve code execution and privilege escalation.

What this means for security teams, FCEB agencies, and adversaries

  • Security teams and technologists: Run the provided CLI check for "/var/tmp/license.tmp," assess internet exposure of FMC management interfaces (Cisco said the attack surface is reduced if the FMC management interface does not have public internet access), and apply the listed hot fixes for affected versions.
  • Federal Civilian Executive Branch (FCEB) agencies: In light of active exploitation, agencies were recommended to apply the fixes by August 1, 2026.
  • Adversaries and threat actors: Cisco’s acknowledgement of active exploitation earlier in the month and the possibility of chaining with CVE-2026-20079 create an elevated operational opportunity for attackers who can reach exposed FMC management interfaces or leverage the static credential vector.

The immediate facts are straightforward: Cisco has publicly described a static-credential weakness in Secure FMC Software that has been exploited in the wild, released hot fixes for multiple product versions, and flagged shared IoCs that defenders can use to hunt for compromise. CISA has placed CVE-2026-20316 on its KEV list, and FCEB agencies face an August 1, 2026, remediation timeline. Cisco has not disclosed the origin, timing, or specific exploitation techniques used in the observed attacks, leaving defenders to act on the published indicators and fixes while monitoring their FMC deployments closely.

Original story

CiscoEmerging ThreatsNetwork SecuritySupply ChainVulnerability ManagementZero-DayCVE-2026-20316FMC SoftwareFirewall Security
Related Intelligence

Continue Reading

Government office building lobby with subtle email setup, blurred figure in background.

Russian Hackers Exploit Exchange Zero-Day for Long-Term Mailbox Access

Russian hackers have unleashed a powerful tool, dubbed OWAReaper, exploiting a zero-day flaw in Exchange Outlook Web Access to gain long-term access to mailboxes, with Proofpoint hailing it as the most sophisticated backdoor delivered via half-click exploits they've ever seen. The attack, linked to the Russian state-sponsored group Laundry Bear, cleverly uses a cross-site scripting flaw to execute arbitrary JavaScript in victims' browsers.

Analyst 207
Rack-mounted device with blinking lights in a network operations center.

Cisco Warns of Actively Exploited FMC Credential Flaw

Cisco is warning of a high-severity vulnerability in its Secure Firewall Management Center (FMC) software, known as CVE-2026-20316, which is being actively exploited by hackers to gain unauthorized access to sensitive data. This flaw allows attackers to log in remotely using built-in static credentials, putting your system at risk.

Analyst 207
Network equipment sits on a rack in a neutral-colored tech room with visible cables.

SonicWall VPNs Targeted in Rapid Credential Stuffing Campaign

In a shocking 41-hour blitz, hackers launched a massive credential stuffing campaign that compromised 92 unique user accounts across 30 organizations using SonicWall VPNs. The rapid attack, which started on Saturday and abruptly ended on Monday, left a trail of breached accounts in its wake.

Analyst 207
Hospital corridor with laptop and medical records on counter, hinting at potential data breach.

ShinyHunters Targets Healthcare with Rising Data Theft Attacks

ShinyHunters is on the hunt, using data theft at cloud scale to target healthcare and medical-tech organizations, leveraging stolen OAuth tokens and corporate single-sign-on accounts to wreak havoc. This notorious extortion gang has successfully breached numerous organizations in the past two years, often through clever social engineering tactics.

Analyst 207