Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20316 5.3
Cisco · Secure Firewall Management Center (FMC) · Added 2026-07-29 · Published 2026-07-29
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
VendorCisco
ProductSecure Firewall Management Center (FMC)
Date added2026-07-29
Due date2026-08-01
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-259
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Descriptions

KEV: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

NVD: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impactpartial
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days
Non-public timeline14 days
Forensic (public)Not required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-25 17:47 UTC
Wall time0.5s
Searches1
Component defaultyes
Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20316/
https://www.helpnetsecurity.com/2026/07/30/cisco-fmc-cve-2026-20316-exploited/
https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/
https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html
https://hoploninfosec.com/cisco-fmc-cve-2026-20316-vulnerability
https://github.com/advisories/GHSA-x85f-hvgg-4944
https://github.com/SecureWithUmer/CVE-2026-PoCs

Hunting hypothesis agent

Hunt FMC web logs for logins using the hardcoded low-priv account, then check for /var/tmp/license.tmp via 'grep license /var/log/messages' on FMC appliances; presence confirms exploitation; rotate all FMC-managed credentials.

Research details

ComponentFMC web interface login (hardcoded low-privileged account credentials)
PreconditionsNetwork reachability to the FMC web management interface over HTTPS; no authentication required for the hardcoded account. Target must run a vulnerable version of Cisco Secure FMC (releases 7.0, 7.2, 7.3, 7.4, 7.6, 7.7, or 10.0). If the FMC management interface is not internet-exposed, the attack surface is reduced. The hardcoded account provides low-privileged access but can be chained with other FMC vulnerabilities (e.g., CVE-2026-20079) for full privilege escalation to root. agent
DeliveryNetwork (HTTPS to FMC web management interface, hardcoded credential login)
Public PoCno
Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
Exploit notesNo public weaponized PoC. Exploitation uses a static, hardcoded low-privilege account built into every vulnerable FMC web interface. Cisco SIR is High (not Medium as NVD CVSS 5.3 suggests; Horizon3 rates CVSS 8.9) because the low-privilege session can be chained with other FMC vulnerabilities (e.g., CVE-2026-20079) for full privilege escalation. Attackers have been observed executing 'cat /var/log/messages | grep license' to check for exploitation artifacts; presence of /var/tmp/license.tmp indicates compromise. The vulnerability was discovered by Horizon3.ai (Jimi Sebree) and is actively exploited as a zero-day.
SummaryCisco Secure Firewall Management Center (FMC) contains a hardcoded static credential (CWE-259) in its web interface, allowing unauthenticated remote login using a low-privileged account. The account is built into all affected FMC versions (7.0 through 10.0); exploitation provides low-privileged access that can be chained with other FMC vulnerabilities for full privilege escalation. Actively exploited as a zero-day; Cisco SIR High. Horizon3.ai discovery. IoC: /var/log/messages grep license, /var/tmp/license.tmp file presence. Hotfixes released for all affected branches.

Tia coverage

First reported2026-07-29
First exploit report2026-07-30
Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-vchipmaker-patch-tuesday-nvidia-amd-arm-issue-security-advisories

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub