Cisco FMC, an account with the password written in: the flaw was already being used when the patch arrived

The console that commands the firewalls

Cisco's Secure Firewall Management Center is not a firewall. It is the control room from which firewalls are governed: policies, rules, updates, logs for the whole fleet. Whoever gets in there does not need to break anything — they can see the map. Which is why a vulnerability affecting access to that console weighs more than its score suggests.

On 29 July 2026 Cisco published advisory cisco-sa-fmc-static-cred-BET3Cjh for CVE-2026-20316. The technical description fits in one line: the web interface of FMC software contains static credentials for a low-privileged account. Static means they are not generated at install time, not chosen by the administrator, not different from one device to the next: they are written into the product. The formal classification is CWE-259, Use of Hard-coded Password.

Anyone who knows them can connect to the management interface — remotely, without authenticating first — and log in as that user, reading whatever sensitive data that account can see.

1. 01
   FMC web interface

   reachable over the network, no prior authentication
2. 02
   Low-privileged account

   static credentials present in the software
3. 03
   Sensitive data read

   everything that user can see on the console

Why 5.3 does not tell the story

The assigned CVSS 3.1 score is 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. In plain terms: network attack, low complexity, no privileges required, no user interaction, impact only on confidentiality and even then limited. No write, no availability. On paper, a medium.

Cisco itself, however, gave the advisory a Security Impact Rating of "High", explicitly above the score, and explained why: this vulnerability can be used together with other FMC vulnerabilities to elevate privileges. It is the textbook case of a number lying when read alone. A read-only account looks like a small thing until it becomes the first step of a staircase.

Patch first, or attack first?

Attack first. In the Exploitation and Public Announcements section Cisco writes that in July 2026 the PSIRT became aware of active exploitation of the vulnerability. The advisory came out on 29 July as version 1.0: when it went public, someone was already using it. That is the definition of a zero-day. On the same 29 July, CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog, reserved for flaws with confirmed exploitation in the wild.

The vulnerability was reported to Cisco by Jimi Sebree of Horizon3.ai, and the internal bug is tracked as CSCwt95997.

1. July 2026
   Cisco PSIRT observes active exploitation

   The flaw is in use before a fix exists.

2. 29 July 2026, 16:00 GMT
   Public advisory, version 1.0

   CVE-2026-20316, CWE-259, SIR "High".

3. 29 July 2026
   Added to the CISA KEV catalog

   Exploitation confirmed: remediation duties kick in.

What is affected and what is not

The vulnerability affects Cisco Secure FMC software regardless of device configuration. Cisco has confirmed that the following are not affected: Cloud-Delivered FMC (cdFMC), Firewall Device Manager (FDM), Secure Firewall ASA software, Secure Firewall Threat Defense (FTD) software and Security Cloud Control. It is a distinction worth reading twice before declaring a fleet exposed or safe.

The advisory adds a note that changes the real risk picture considerably: if the FMC management interface is not reachable from the public internet, the attack surface associated with this vulnerability is reduced. It does not disappear — anyone already inside the network is still in play — but it narrows a great deal.

How to check whether it happened

Cisco publishes an indicator of compromise you can check in seconds. In expert mode on the device:

cat /var/log/messages | grep license

If the output contains a line referring to /var/tmp/license.tmp — in the advisory's example, a call to package_info.pl /var/tmp/license.tmp --lsm run by the www user — the vulnerability may have been exploited on that device. In that case Cisco says to contact TAC for recovery options.

And it gives one recommendation that should be read as the real emergency measure: at a minimum, rotate all user credentials, keys and certificates on the FMC, because active exploitation is ongoing. It is the same reasoning seen in other hard-coded credential cases: the patch shuts the door, it does not undo what has already been read and carried out.

Fixing it: hot fixes only

There are no workarounds. Cisco has released hot fixes, downloadable from the Software Center, for the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 lines. Anyone unsure which release is covered can use the Cisco Software Checker referenced in the advisory. A sensible order of operations: check whether the management interface is exposed and take it off the internet if it is, apply the hot fix, look for the indicator in the logs, rotate credentials and certificates.

What we do not know

This deserves to be said plainly. Cisco does not attribute the exploitation to any group, does not say when it started beyond a generic "July 2026", and does not quantify how many devices were hit. There is no verifiable public data on how many FMC installations have their management interface exposed to the internet: any figure circulating should be treated as a third-party estimate, not as advisory data. And the note about chaining with "other FMC vulnerabilities" does not say which ones: Cisco says the staircase exists, not how many steps it has.

One point, though, needs no further confirmation: in 2026, in a security product, a fixed password written into the software was found by a researcher, used by someone, and catalogued by CISA on the very day it became public.