Cisco firewall manager had a hidden password. Attackers found it first.
A built-in account in Cisco Secure Firewall Management Center was exploited as a zero-day in July, and Cisco is telling customers to patch and hunt for a specific log entry.
Key points
- Cisco confirmed active exploitation of CVE-2026-20316, a hard-coded credential flaw in Secure Firewall Management Center (FMC), starting July 2026.
- The bug lets anyone on the network log in as a low-privilege account, then chain other unnamed FMC flaws to escalate.
- A second, unrelated flaw, CVE-2026-20079, scores a maximum 10.0 and gives root without any credentials at all.
- Hot fixes exist for FMC 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. There are no workarounds.
- Both advisories point to the same indicator: a suspicious
/var/tmp/license.tmpentry in/var/log/messages.
Cisco has told customers that its Secure Firewall Management Center, the console admins use to run large fleets of Cisco firewalls, shipped with a built-in account and password. Attackers found the account before defenders did, and were using it in the wild by July 2026.
The flaw is tracked as CVE-2026-20316. In plain English: the software came with a login that nobody set, nobody rotated, and nobody could remove. Anyone who can reach the management interface over the network can use it.
In practice, that account is low-privilege on its own. Cisco says attackers were pairing it with other, unnamed bugs in FMC to climb to root. The company has not said which bugs, who the attackers are, or which organisations got hit. First reported by BleepingComputer.
What is FMC and why should anyone care?
FMC is the brain that manages Cisco firewalls across a company. If you own the brain, you own the rules that decide what traffic gets into a network and what gets blocked. That is why a mid-scoring 5.3 CVSS bug still got a High severity rating from Cisco: the access it gives is a stepping stone, not the destination.
The failure mode here is familiar. Static credentials in a shipped product are the kind of finding a pen tester writes up on day two. Jimi Sebree of Horizon3.ai reported this one to Cisco.
Which versions are affected?
All on-premise FMC versions are affected, regardless of how the box is configured. Cloud-Delivered FMC, Firewall Device Manager, ASA, Secure Firewall Threat Defense and Security Cloud Control are not.
| Product | Affected releases | Fix |
|---|---|---|
| Cisco Secure FMC Software | 7.0, 7.2, 7.4, 7.6, 7.7, 10.0 | Hot fix per branch |
| Cloud-Delivered FMC | Not affected | N/A |
| ASA, FTD, FDM, SCC | Not affected | N/A |
There are no workarounds. Cisco says exposure drops sharply when the management interface is not reachable from the public internet, which it should not be in any sensible deployment.
How do I know if I was hit?
Check /var/log/messages on the FMC device. From expert mode, run cat /var/log/messages | grep license and look for lines like:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
That entry shows the web process (running as www) invoking Cisco's package_info.pl script as root against a file in /var/tmp. If you see it, treat the box as owned: rotate every credential, key and certificate on the device, and call Cisco TAC.
The other flaw is worse, but Cisco says nobody has used it
On the same advisory cycle, Cisco updated a separate FMC bug, CVE-2026-20079, which carries a CVSS of 10.0. This one needs no login at all. A crafted HTTP request lands the attacker at root because of a broken system process created at boot.
Cisco first disclosed it in March 2026 and refreshed the advisory on 29 July with hot fixes and indicators. Cisco says it has not seen this one exploited. Awkwardly, the same /var/tmp/license.tmp indicator appears in both advisories, and the company has not explained whether the two bugs are connected or whether the shared IOC was intentional.
One thing the post-mortem will say: if your firewall manager sits behind nothing but a management VLAN and a hope, apply the hot fix today and grep the logs before you go home.
