CVE-2026-20316

Cisco Releases Hotfixes for Actively Exploited CVE-2026-20316 Zero-Day in Secure FMC Allowing Static Credential Access

A zero-day vulnerability tracked as CVE-2026-20316 is being actively exploited in Cisco Secure Firewall Management Center, enabling remote attackers to authenticate using hardcoded low-privilege credentials without prior authentication. The flaw carries a CVSS score of 5.3 but has been elevated to High severity by Cisco due to its potential for chaining with other vulnerabilities to achieve privilege escalation. Cisco has issued hotfixes across multiple versions including 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 while urging administrators to inspect logs for the presence of /var/tmp/license.tmp as an indicator of compromise. The same indicator is also linked to the related critical authentication bypass CVE-2026-20079 that can lead to root access via script execution. Organizations are advised to restrict management interface exposure through ACLs, VPNs and dedicated admin networks, rotate credentials after suspected compromise, and review sudo executions and license-related commands. U.S. federal agencies have a remediation deadline of August 1, 2026 under the Known Exploited Vulnerabilities catalog.

Cisco Secure Firewall Management Center Patched for Hardcoded Credential Vulnerability CVE-2026-20316 Already Exploited in the Wild

Cisco Systems has disclosed and patched a hardcoded credential vulnerability in its Cisco Secure Firewall Management Center (FMC) product that allows remote attackers to log in and access sensitive information. The flaw, tracked as CVE-2026-20316, affects the web interface and carries a CVSS v3.1 base score of 5.3, yet Cisco rated it High severity due to the risk of privilege escalation when chained with other vulnerabilities. Zero-day exploitation was observed in July 2026, prompting immediate action from both the vendor and U.S. authorities. CISA added the issue to its Known Exploited Vulnerabilities catalog on the same day and directed federal agencies to apply mitigations by August 1. The advisory highlights that the static credentials enable low-privileged access that could be leveraged for more severe attacks. Cisco released the security advisory on July 29, 2026, and urged customers to update their deployments promptly.