Cisco has confirmed that attackers are actively exploiting CVE-2026-20316, a static credentials vulnerability in the Cisco Secure Firewall Management Center (FMC). The warning was echoed by the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday and ordered federal civilian executive branch agencies to remediate the issue by August 1, 2026.
The vulnerability exists in the FMC software's web-based management interface. It involves hard-coded static user credentials assigned to a low-privileged account. An attacker who obtains those credentials can log into an affected FMC device and potentially access sensitive data stored or processed by the management platform. The credentials are not unique per deployment; they are present in the software by default, making the exposure especially dangerous if the management interface is reachable from the internet.
Cisco credits security researcher Jimi Sebree of Horizon3.ai with reporting the flaw. In a security advisory, the company said the vulnerability could be exploited on its own or combined with other weaknesses. By chaining CVE-2026-20316 with additional flaws, an attacker might be able to elevate privileges beyond the low-privileged account, potentially achieving deeper access to the device and the wider security infrastructure it controls. Cisco did not state that such chaining has been observed in the wild, but the possibility remains a concern for organizations that manage many firewalls through a single FMC instance.
Active exploitation and federal mandate
CISA placed CVE-2026-20316 on its KEV catalog on Wednesday, July 30, 2026. The catalog lists vulnerabilities that have been confirmed as exploited in the wild, and federal agencies are expected to patch them quickly. Under the binding operational directive that governs the catalog, US civilian federal agencies must apply the vendor-provided hotfix or implement mitigating controls by August 1, 2026. They are also directed to review their installations for signs of compromise and report any findings to CISA.
Cisco said its Product Security Incident Response Team became aware of active exploitation this month. The company has made hotfixes available to address the vulnerability and has published guidance for checking system logs. According to Cisco, the presence of an execution of package_info.pl referencing /var/tmp/license.tmp is a strong indicator of possible exploitation. Organizations using FMC should inspect their logs for that pattern immediately.
For organizations that suspect their FMC devices may already be compromised, Cisco advises contacting the Technical Assistance Center (TAC) for help with recovery options. At a minimum, the company recommends rotating all user credentials, keys, and certificates on the affected Cisco Secure FMC device because active exploitation has been ongoing. Even if no signs of compromise are found, credential rotation is a prudent step to reduce the risk posed by static credentials that may have been exposed.
Why FMC is an attractive target
Cisco Secure Firewall Management Center is a centralized platform used to manage large numbers of Cisco Secure Firewall appliances. It lets administrators define and push firewall policies, monitor security events, manage access rules, and gain visibility into network traffic. Because FMC stores configuration details, security policies, and potentially credentials for managed devices, it is a high-value target for attackers. Gaining access to the management plane can effectively neutralize the security controls deployed throughout an enterprise network.
FMC's web interface has become a recurring weak point. In March 2026, Cisco disclosed two critical FMC vulnerabilities. The first, CVE-2026-20079, was an authentication bypass vulnerability that could let unauthenticated attackers bypass authentication and execute script files on an affected device, potentially obtaining root access to the underlying operating system. At the time, Cisco said its incident response team was not aware of any public announcements or malicious use of that flaw. Still, the severity of an unauthenticated root access vector made it a priority for patching.
The second disclosed flaw, CVE-2026-20131, was a remote code execution vulnerability. Attackers could exploit it by sending a crafted serialized Java object to a vulnerable device's web-based management interface. This flaw quickly gained attention when Amazon's CISO, CJ Moses, revealed that honeypots run by the company had detected the Interlock ransomware gang exploiting CVE-2026-20131 as a zero-day as early as January 26, 2026. The discovery demonstrated that threat actors are actively hunting for FMC vulnerabilities and are willing to exploit them within days of learning about them.
The emergence of CVE-2026-20316 as the latest FMC flaw to be exploited in the wild shows that attackers are not done with this management platform. The static credentials issue is particularly troublesome because it does not require an advanced exploit chain. If an attacker can reach the FMC web interface, the static credentials may be enough to gain an initial foothold. Even a low-privileged account can provide access to logs, configuration snippets, or other information that supports further attacks.
Mitigation and hardening recommendations
Cisco has explicitly noted that the attack surface associated with the vulnerability is reduced if the FMC management interface does not have public internet access. Administrators should ensure that FMC management interfaces are only reachable through trusted networks, such as internal management VLANs or through secure jump hosts. Exposing the management interface directly to the internet increases the risk of automated scanning and credential-based attacks.
In addition to applying the hotfix and rotating credentials, organizations should review their firewall and FMC configurations for unauthorized changes. They should also monitor for unusual activity originating from the FMC device, such as unexpected outbound connections, script execution, or modifications to system files. The IoC identified by Cisco, involving package_info.pl and /var/tmp/license.tmp, should be checked against existing logs and included in future monitoring rules.
Network defenders should also consider whether any other services are exposed on the same management interface. Cisco recommends applying the principle of least privilege, enforcing multi-factor authentication wherever possible, and maintaining a rigorous patch management schedule for FMC appliances. Because FMC is a central control point, a compromise can have a cascading effect on every managed firewall. Ensuring that access to FMC is tightly controlled and continuously monitored is essential for reducing the likelihood of a successful attack.
The news of CVE-2026-20316 follows a period of heightened interest in Cisco FMC among threat actors. The Interlock ransomware incident, in particular, highlighted how quickly a vulnerability in the platform can be weaponized. Security teams should treat any FMC exposure with caution and assume that known vulnerabilities in the web interface will continue to be targeted until they are patched and the attack surface is reduced.
Organizations that have not yet applied the available hotfix should do so as soon as possible. Those that already have evidence of exploitation should work with Cisco TAC to contain the incident, preserve forensic details, and restore the affected system to a known-good state. The broader lesson is clear: centralized security management platforms are now in the crosshairs of attackers, and static credentials or other weaknesses in these platforms can have outsized consequences.
Source: Help Net Security News