Unauthenticated attackers exploit hard-coded credentials in Cisco Secure Firewall Management Center

Summary

Cisco has issued a warning regarding CVE-2026-20316, a vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) that is currently being exploited in the wild. The flaw stems from static user credentials for a low-privileged account built directly into the software. An unauthenticated, remote attacker can use these credentials to log in and access sensitive information available to that specific account.

While the CVSS score is rated at 5.3 (Medium), Cisco has assigned it a High Security Impact Rating because the vulnerability can be used alongside other FMC flaws to achieve privilege escalation. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 29, 2026, following evidence of active exploitation.

Technical Details

The core issue is the presence of hard-coded credentials for a low-privilege account within the FMC web interface. This allows an attacker to bypass standard authentication processes by simply using these static credentials.

The impact of this flaw depends heavily on network exposure. If the FMC management interface is not accessible via the public internet, the attack surface is significantly reduced. However, for exposed systems, the risk remains high as attackers can gain a foothold within the system.

Cisco has noted that while this vulnerability allows access to sensitive data as a low-s-privileged user, it can be combined with other vulnerabilities-which Cisco has not yet identified or detailed-to elevate those privileges further.

Affected Products and Fixed Versions

The vulnerability affects Cisco Secure FMC Software regardless of the specific device configuration. It does not impact Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, or Security Cloud Control.

Cisco has released hot fixes for the following versions:

Detection Opportunities

To determine if a Cisco FMC installation has been compromised, administrators should inspect the /var/log/messages log file. Specifically, look for entries where the www account invokes the package_info.pl script as root while supplying a specific temporary license file.

Run the following command in expert mode to search for this activity:

cat /var/log/messages | grep license

A log entry matching this pattern indicates a potential compromise:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

Why this matters for defenders

Because exploitation has been ongoing, a successful attack may have already occurred before a patch was applied. If your logs show the /var/tmp/license.tmp indicator mentioned above, you must treat the device as compromised.

In such cases, Cisco recommends contacting the Cisco Technical Assistance Center (TAC) for recovery assistance. At a minimum, rotate all user credentials, keys, and certificates on the affected FMC device immediately.

There are no workarounds available to mitigate this vulnerability; upgrading to the fixed software versions listed above is the only way to address the flaw.