All Articles

What Happened

On July 29, 2026 at 16:00 GMT, Cisco published advisory cisco-sa-fmc-static-cred-BET3Cjh (bug ID CSCwt95997) for CVE-2026-20316, a static credential vulnerability in the web interface of Secure Firewall Management Center software. Cisco PSIRT says it became aware of active exploitation in July 2026, before a patch existed. That makes this a zero-day, not a theoretical finding.

The same day, CISA added the CVE to the Known Exploited Vulnerabilities catalog as a "Use of Hard-coded Password" vulnerability. Under Binding Operational Directive 26-04, US federal civilian agencies must prioritize remediation. CISA recommends every organization treat KEV entries the same way.

Jimi Sebree of Horizon3.ai reported the flaw to Cisco.

Technical Root Cause

This is CWE-259: a hard-coded password. Cisco shipped FMC software with static credentials for a low-privileged account in the web interface. Anyone who knows those credentials can authenticate to any reachable FMC instance, regardless of device configuration, and read data available to that account.

The CVSS base score is only 5.3 because the account is low-privileged. Cisco still assigned a High Security Impact Rating for one reason: the foothold can be combined with other FMC vulnerabilities to elevate privileges. Cisco has not named those chained vulnerabilities, per BleepingComputer's reporting, which leaves defenders scoring this on trust rather than data. Treat the effective severity as the chain, not the CVE.

Scope: What Is and Is Not Affected

• Affected: Cisco Secure FMC Software, all configurations.
• Not affected: Cloud-Delivered FMC (cdFMC), Firewall Device Manager (FDM), Secure Firewall ASA software, Secure Firewall Threat Defense (FTD) software, and Security Cloud Control.

Note the asymmetry: your firewalls (FTD, ASA) are fine. The system that manages them all is not. Compromising a management plane yields policy control over every enforcement point behind it, which is why attackers went after FMC and not the firewalls themselves.

The Companion Problem: CVE-2026-20079

Also on July 29, Cisco updated its advisory for CVE-2026-20079, a critical FMC authentication bypass scored CVSS 10.0. It allows an unauthenticated remote attacker to bypass authentication and execute scripts as root via crafted HTTP requests, caused by an improper system process created at boot. It was originally disclosed in March 2026; the July 29 update added a second bug ID, hot fixes, and indicators of compromise. Cisco says it is not aware of exploitation of this one, but published the same /var/tmp/license.tmp IoC in both advisories without explaining the connection. If you are patching FMC for one, you are patching for both.

Detection: One Command, Right Now

Cisco published a concrete IoC. On the FMC, from expert mode as root:

cat /var/log/messages | grep license

Compromise indicator: a sudo log line showing the www user (the FMC web process) running package_info.pl as root against a file named /var/tmp/license.tmp:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

If you forward FMC syslog to your SIEM, write the detection there too: alert on any package_info.pl execution referencing a file in /var/tmp, and more broadly on the www user invoking sudo for anything outside its normal baseline.

Remediation

There are no workarounds. Cisco released hot fixes, downloadable from the Cisco Software Center:

If the IoC is present, Cisco's guidance is unambiguous: rotate all user credentials, keys, and certificates on the FMC device, and engage Cisco TAC for recovery. Exploitation has been ongoing, so assume any exposed, unpatched FMC has been probed.

What This Means for Security Teams

Management interfaces keep proving to be the soft underbelly of network security products. Cisco notes the attack surface shrinks when the FMC management interface is not reachable from the public internet. Inventory question for today: can you list every FMC, and does any of them answer HTTPS from outside your management network? This is the same dynamic attack surface problem we discussed in our fireside chat with Rick Doten on managing a dynamic attack surface.

The deeper issue is vendor-shipped static credentials in 2026. CWE-259 is a supply chain defect you inherit with the appliance, a theme Cassie Crossley covered in our supply chain security fireside. Your product security questionnaires should ask vendors directly whether builds are scanned for embedded credentials.

If you do one thing today: run the grep on every FMC you own, then apply the hot fix. Both take minutes. The credential rotation you will need if you wait does not.

Immediate Action Checklist

1. Inventory: enumerate all Secure FMC instances (on-prem; cdFMC is not affected) and their software versions.
2. Detect: run cat /var/log/messages | grep license on each FMC; look for /var/tmp/license.tmp.
3. Patch: apply the hot fix for your release train (7.0 through 10.0). No workaround exists.
4. Contain: confirm no FMC management interface is internet-exposed; restrict to a management VLAN or jump host.
5. Respond: if the IoC matches, rotate all FMC credentials, keys, and certificates and contact Cisco TAC.
6. Monitor: add a SIEM rule for the www user executing package_info.pl or sudo commands referencing /var/tmp.
7. Cover the companion: verify the same hot fixes close CVE-2026-20079 (CVSS 10.0 auth bypass) on all instances.

Community Note

This incident is a management plane exposure problem: the vulnerable asset is one most teams do not think of as internet-facing until a scan proves otherwise. If you want an outside-in check of what your organization actually exposes, FireCompass offers a free self-serve AI pen test (Free Explorer) for the community. No asset list and no credit card needed; it discovers your attack surface and validates exposures like reachable admin interfaces.

Join the Discussion

Practitioner questions for the community:

• Do you forward FMC /var/log/messages to your SIEM today, or is the management plane a logging blind spot in your environment?
• How do you handle emergency hot fixes on HA FMC pairs: patch in place during business hours or wait for a window and accept the exposure?
• Should chainable low-CVSS flaws like this one (5.3 base, High rating) be triaged on vendor severity, CVSS, or KEV presence in your program?

Sources

• Cisco Security Advisory: Secure FMC Static Credential Vulnerability (cisco-sa-fmc-static-cred-BET3Cjh), July 29, 2026
• CISA Alert: CISA Adds One Known Exploited Vulnerability to Catalog, July 29, 2026
• BleepingComputer: Cisco warns of FMC static credential flaw exploited in zero-day attacks, July 29, 2026