Cisco firewall manager had a hidden password. Attackers found it first.
A built-in account in Cisco Secure Firewall Management Center was exploited as a zero-day in July, and Cisco is telling customers to patch and hunt for a specific log entry.
Key points
- Cisco confirmed active exploitation of CVE-2026-20316, a hard-coded credential flaw in Secure Firewall Management Center (FMC), starting July 2026.
- The bug lets anyone on the network log in as a low-privilege account, then chain other unnamed FMC flaws to escalate.
- A second, unrelated flaw, CVE-2026-20079, scores a maximum 10.0 and gives root without credentials.
- Hot fixes exist for FMC 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. There are no workarounds.
- Both advisories point to the same indicator: a suspicious
/var/tmp/license.tmpentry in/var/log/messages.
Cisco has told customers that its Secure Firewall Management Center, the console admins use to run large fleets of Cisco firewalls, shipped with a built-in account and password. Attackers found it before defenders did, and were exploiting it in the wild by July 2026.
The flaw is tracked as CVE-2026-20316. The software came with a login that was never set by the customer, can't be rotated out, and can't be removed. Anyone who can reach the management interface over the network can use it.
That account is low-privilege on its own. Cisco says attackers were pairing it with other, unnamed FMC bugs to reach root. The company hasn't said which bugs, who the attackers are, or which organisations got hit. The story was first reported by BleepingComputer.
What is FMC and why should anyone care?
FMC is the brain that manages Cisco firewalls across a company. Own the brain, own the rules that decide what traffic enters a network and what gets blocked. That's why a mid-scoring 5.3 CVSS bug still earned a High severity rating from Cisco: the access it gives is a stepping stone, not a destination.
The failure mode is familiar. Static credentials in a shipped product are the kind of finding a pen tester writes up on day two. Jimi Sebree of Horizon3.ai reported this one to Cisco. It's worth comparing to what we covered on 23 July with Check Point's management console flaw: different vendor, same class of mistake, ten organisations hit before a patch arrived.
Which versions are affected?
All on-premise FMC versions are affected, regardless of configuration. Cloud-Delivered FMC, Firewall Device Manager, ASA, Secure Firewall Threat Defense and Security Cloud Control are not.
| Product | Affected releases | Fix |
|---|---|---|
| Cisco Secure FMC Software | 7.0, 7.2, 7.4, 7.6, 7.7, 10.0 | Hot fix per branch |
| Cloud-Delivered FMC | Not affected | N/A |
| ASA, FTD, FDM, SCC | Not affected | N/A |
No workarounds exist. Exposure drops sharply when the management interface isn't reachable from the public internet, which it shouldn't be in any sensible deployment.
How do I know if I was hit?
Check /var/log/messages on the FMC device. From expert mode, run cat /var/log/messages | grep license and look for lines like:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
That entry shows the web process running as www invoking Cisco's package_info.pl script as root against a file in /var/tmp. See it, and treat the box as owned: rotate all credentials and certificates on the device and call Cisco TAC.
The other flaw is worse, but Cisco says nobody has used it
CVE-2026-20079 carries a CVSS of 10.0. It needs no login at all. A crafted HTTP request lands the attacker at root because of a broken system process created at boot. Cisco first disclosed it in March 2026 and refreshed the advisory on 29 July to add hot fixes and indicators. The same /var/tmp/license.tmp pattern appears in both advisories, and Cisco hasn't explained whether the bugs are connected or whether the shared indicator was intentional.
The post-mortem template writes itself: if your firewall manager sits behind nothing but a management VLAN and good intentions, apply the hot fix today and grep the logs before you go home.
