---
title: "Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password"
url: https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/
description: "A static low-privilege login in on-prem Cisco Secure FMC is exploited and ransomware-linked per CISA. Fixed in 7.4.8, 7.6.6, 7.7.13, 10.0.2. Patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-07-29
date_modified: 2026-09-16
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-20316"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password

**Verdict: Act now.** If you run on-premises Cisco FMC and have not installed the July hot fix or a September hardening release, upgrade now and check for the published indicator; the login needs no guessing and CISA ties the bug to ransomware.

- **Who must act:** Anyone running on-premises Cisco Secure Firewall Management Center (hardware or virtual), most urgently where its web interface is reachable from the internet or from broad internal networks.
- **Who can relax:** Teams with no Cisco firewalls, and those using Cloud-Delivered FMC, Security Cloud Control or on-box Firewall Device Manager, which Cisco confirms are not affected.
- **Affected:** Cisco Secure FMC 7.0 and earlier before 7.0.10; Cisco Secure FMC 7.2 before 7.2.12; Cisco Secure FMC 7.3 (listed as affected; no 7.3 fixed release in the advisory); Cisco Secure FMC 7.4 before 7.4.8; Cisco Secure FMC 7.6 before 7.6.6; Cisco Secure FMC 7.7 before 7.7.13; Cisco Secure FMC 10.0 before 10.0.2
- **Fixed:** FMC 7.0.10; FMC 7.2.12; FMC 7.4.8; FMC 7.6.6; FMC 7.7.13; FMC 10.0.2; FMC 10.1.0
- **CVEs:** CVE-2026-20316
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every on-premises FMC (appliance and virtual) and note its software version.
2. Run Cisco's indicator check in expert mode before upgrading: sudo zgrep "package_info.*license" /var/log/messages*
3. Upgrade to the fixed hardening release for your train (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0); move 7.3 systems to a fixed train.
4. Remove any internet exposure of the FMC web interface and limit it to an admin network or jump host.
5. If the indicator appears, contact Cisco TAC and rotate all user credentials, keys and certificates on the FMC.
6. Review the managed firewalls for policy deployments and admin changes you did not make.

### How to check if you are affected

- In expert mode, run zgrep "package_info.*license" /var/log/messages*; any line referencing /var/tmp/license.tmp may indicate exploitation.
- Review FMC audit logs for web logins by unfamiliar or built-in low-privilege accounts and for unexpected policy deployments.
- Check firewall and proxy logs for whether the FMC web interface was reachable from the internet at any point since July 2026.

## What happened

On July 29, 2026, Cisco published [CVE-2026-20316](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh), a hard-coded password flaw (CWE-259) in the web interface of on-premises Cisco Secure Firewall Management Center (FMC), the console that manages Cisco's Secure Firewall Threat Defense devices. FMC ships with static credentials for a low-privileged account. Anyone who can reach the web interface can log in with them and read whatever that account can see. Cisco says its PSIRT became aware of active exploitation in July 2026. CISA added the CVE to the [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316) the same day, set an August 1 deadline for federal agencies, and marks it as known to be used in ransomware campaigns. None of the sources reviewed names a ransomware group for this CVE.

The CVSS 3.1 base score is only 5.3 (Medium), because the account on its own exposes limited data. Cisco still rates the advisory High because the flaw "can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges." Jimi Sebree of Horizon3.ai and Andy Niu of TrendAI Research reported the bug.

## Who is affected

Every on-premises FMC is affected, regardless of configuration. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-20316) lists builds from 7.0.0 through 7.7.12 and 10.0.0 through 10.0.1. Cisco first shipped hot fixes. Since September 16 the advisory instead points to its September 2026 hardening releases, which also carry fixes for other internally found bugs:

- 7.0 and earlier: 7.0.10
- 7.2: 7.2.12
- 7.4: 7.4.8
- 7.6: 7.6.6
- 7.7: 7.7.13
- 10.0: 10.0.2, and 10.1.0 includes the fix

The CVE record also lists 7.3 builds as affected, but the fixed-release table has no 7.3 row, so those systems need to move to a fixed train. Cisco confirms that Cloud-Delivered FMC, Firewall Device Manager, ASA and FTD software, and Security Cloud Control are not affected.

## Do you really need to act?

If you run on-premises FMC, yes. A static credential needs no brute forcing or phishing, and CISA's assessment marks exploitation as automatable. FMC holds the policy and device configuration for every firewall it manages, so even read access is valuable reconnaissance. The chaining risk is not hypothetical, because FMC has had other serious bugs this year. [Help Net Security](https://www.helpnetsecurity.com/2026/07/30/cisco-fmc-cve-2026-20316-exploited/) recounts Amazon's report that the Interlock ransomware gang exploited CVE-2026-20131, an FMC deserialization RCE, as a zero-day starting January 26, 2026. CVE-2026-20079, a CVSS 10.0 authentication bypass to root, received the same hot fixes and the same indicator of compromise on July 29, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/). CISA added that CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079) on September 9.

Cisco says keeping the FMC management interface off the public internet reduces the attack surface. Reduced does not mean gone: a compromised internal workstation can usually reach it. Teams without on-premises FMC, which includes most software and cloud-only shops, have nothing to do here.

## What to do now

1. Inventory every FMC appliance and virtual FMC and note its version, for example under Help > About in the web interface.
2. Check for the indicator *before* upgrading, because Cisco says the fixes prevent future exploitation but may not address an existing compromise: enter `expert`, then `sudo su`, then run `zgrep "package_info.*license" /var/log/messages*`.
3. Upgrade to the fixed release for your train (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0). There is no workaround.
4. Restrict the FMC web interface to an admin network or jump host, and remove any internet-facing access rule or NAT.
5. If the indicator appears, contact Cisco TAC. Cisco's original guidance was to "rotate all user credentials, keys, and certificates on the Cisco Secure FMC device."

## How to tell if you were hit

Cisco's example log line shows the web server user `www` running `/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm` as root through sudo. Any output that references `/var/tmp/license.tmp` may mean the device was exploited. Cisco revised the check several times between July 31 and August 5, so use the command in the current advisory. The same indicator appears in the CVE-2026-20079 advisory, so a hit does not tell you which bug was used. Treat it as a full compromise either way. Also review FMC audit logs for logins by accounts you do not recognize and for policy deployments nobody on your team made, and check whether the web interface was ever reachable from the internet since July.

## Timeline

- Jul 29, 2026 — Cisco publishes the advisory and hot fixes, citing active exploitation. CISA adds CVE-2026-20316 to KEV with known ransomware use.
- Jul 31, 2026 — Cisco begins revising the indicator-of-compromise guidance, with further updates on August 3 and 5.
- Aug 1, 2026 — CISA's remediation deadline for federal agencies.
- Sep 9, 2026 — CISA adds the related FMC flaw CVE-2026-20079 to KEV.
- Sep 16, 2026 — Cisco replaces the hot fixes with September 2026 hardening releases (advisory version 1.6).

## Sources

1. [Cisco — Cisco Secure Firewall Management Center Software Static Credential Vulnerability (cisco-sa-fmc-static-cred-BET3Cjh)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh)
2. [CVE record — CVE-2026-20316](https://www.cve.org/CVERecord?id=CVE-2026-20316)
3. [NVD — CVE-2026-20316](https://nvd.nist.gov/vuln/detail/CVE-2026-20316)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-20316](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-20079](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079)
6. [BleepingComputer — Cisco warns of FMC static credential flaw exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/)
7. [Help Net Security — Cisco FMC static credentials exploited by attackers (CVE-2026-20316)](https://www.helpnetsecurity.com/2026/07/30/cisco-fmc-cve-2026-20316-exploited/)

---
Source page: https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20316-hard-coded-password/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt