Cisco FMC CISA KEV Active Exploit

Cisco FMC CVE-2026-20316: a 5.3 that ends in root

Jul 31, 2026·8 min read·Chris Boker, Founder, CVEasy AI
A green FMC control-plane hub on the left carries a small gold key tile locked into its base representing the hardcoded low-privilege account, a mint boot arrow curves in from the top showing the reboot condition, a rust pathway from the key tile crosses a broken green auth gate in the middle and lands on a black CGI script tile stamped with a gold root seal on the right, and a bold rust arrow fans out from the root tile to a stacked column of downstream firewall appliances each carrying a broken rust padlock

On July 29, 2026, Cisco published cisco-sa-fmc-static-cred-BET3Cjh, a static credential advisory for on-premises Secure Firewall Management Center. The CVE was CVE-2026-20316, the CVSS base score was 5.3, and the description said the built-in account was low-privilege. On a normal Monday that combination lands the ticket somewhere in the middle of the backlog.

Two things buried in the same publication push it to the top of the week. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog the same day, with a Federal Civilian Executive Branch patching deadline of August 1, 2026. A Cisco security product actively exploited before the patch existed, on a three-day KEV clock, is not a middle-of-the-backlog finding. The second thing Cisco did not headline: CVE-2026-20079, a CVSS 10.0 pre-auth authentication bypass that lets an attacker run scripts as root on the FMC. Cisco's July hotfix ships the fix for both, and both advisories now share the same forensic indicator. That is not a coincidence.

What the credential actually is

The hardcoded account is not a leftover from testing. It ships in every on-prem Secure FMC image across the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 release branches. The username is fixed, the password is fixed, and any attacker with network reach to the FMC web interface can authenticate as that account without ever touching the primary admin credential. Horizon3.ai's Jimi Sebree reported the issue to Cisco, who filed it as CWE-259, use of hard-coded password, at a CVSS base score of 5.3.

That rating reflects what the account sees on its own. It does not reflect what the account does when composed with the rest of the box. Read access to portions of the FMC configuration is already interesting: the FMC holds the policy definitions for every Cisco Secure Firewall it manages, plus the certificates, API keys, and integration secrets those firewalls use to talk to ISE, Splunk, Talos, and every cloud connector you have wired in. A low-privilege authenticated session at this layer already sees your ACL structure, your VPN topology, and allow-lists you thought were internal. It is not a scanner viewpoint. It is a session Cisco never intended to expose.

The chain that turns it into root

CVE-2026-20079 was disclosed on March 4, 2026, with a CVSS of 10.0. VulnCheck's writeup lays out the mechanism: an FMC boot process creates a partial csm_processes session inside the sfsnort.sessions database before any user has authenticated. If no operator logs in between the reboot and the attack, that partial session persists. An unauthenticated caller who reaches the web interface can pick it up, treat it as an authenticated context, and call the same CGI scripts an operator would. Those CGI scripts run as root. The precondition, that the FMC has rebooted with no operator login yet, is met in quiet operations more often than most teams assume.

Chain the two. The static credential account from CVE-2026-20316 is an authenticated session Cisco never meant to expose. In CVE-2026-20079, the auth bypass creates an authenticated session Cisco never meant to make. Both surface into the same session and CGI perimeter, and either footing leads into code that runs as root. Cisco's July hotfix also carries updated protection for CVE-2026-20079 and CVE-2026-20131, and the reissued CVE-2026-20079 advisory now names the same forensic indicator. The chain is what the incident responders are seeing, not a theoretical concern.

The forensic indicator both advisories share

Cisco's public guidance on both CVE-2026-20316 and CVE-2026-20079 tells administrators to look in the FMC system log for the execution of package_info.pl referencing /var/tmp/license.tmp. That artifact does not appear during normal operation. It appears during exploitation of the chain. Publishing the same string in both advisories is Cisco's way of saying, without saying, that they see one attack signature spanning both bugs.

If /var/tmp/license.tmp shows up in FMC syslog: Treat the appliance as compromised. Rotate every credential, API key, and certificate reachable from that FMC before you rebuild it. The hotfix stops the primitive; it does not evict an attacker who already ran it.

What the 5.3 score is hiding

CVSS scores a single vulnerability against a static, abstract victim. The formula has no way to know the account composes with an auth bypass in the same product, that Cisco's hotfix packages both fixes into one file, or that the FMC is the control plane for a fleet of downstream firewalls, so a compromise here is not one appliance, it is your entire firewall estate's policy language and its secrets store. A scanner queue sorted by base score alone will push CVE-2026-20316 below a dozen 7.x findings on tools nobody actually exposes to the internet. That is the mis-ranking that keeps FCEB agencies missing an August 1 deadline.

How TRIS scores it against your inventory

TRIS, our Threat and Risk Intelligence Scoring engine inside CVEasy AI, does not queue by CVSS. It composes a per-finding score across a small set of independent signal layers, then decides the queue slot per asset rather than per CVE. For this bug the layers agree quickly.

Exploitation signal. Confirmed active exploitation before patch availability, CISA KEV listing on the same day as the Cisco advisory, and a published forensic string all point one direction. On an exposed FMC that signal alone lands the finding in the ACT band, our top severity tier.

Chain awareness. TRIS reads Cisco's own remediation packaging: one hotfix covers both the credential fix and the root RCE, and the reissued CVE-2026-20079 advisory names the same forensic string. The score treats CVE-2026-20316 as the entry point of a proven root-RCE chain, not as an isolated 5.3.

Exposure context. An FMC whose management interface is reachable from a segment carrying user traffic, VPN concentrators, or any internet-facing hop is a top-band ACT finding. The same box on a jump-host-only administration VLAN with layer 4 restrictions to a small admin CIDR shrinks toward the ATTEND band, and a lab FMC behind a physical air gap sits at TRACK. Same CVE, three queue slots, one asset inventory difference.

Blast radius. A single compromised FMC exposes every downstream firewall's policy, the certs and tokens it uses to reach ISE, Splunk, and cloud connectors, and any integration secrets the FMC provisioned. TRIS treats blast radius as a score input, not a footnote.

None of this is pitch language. It is the layer walk we run on every finding, and this one lands where it lands because the layers agree.

The honest weekend list: patch, hunt, rotate

Patch. Apply the release-specific hotfix from cisco-sa-fmc-static-cred-BET3Cjh to every on-prem FMC running 7.0, 7.2, 7.4, 7.6, 7.7, or 10.0. The FMC 10.0 fix ships as Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar; each other branch has its own artifact. There are no workarounds. Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA, Secure Firewall Threat Defense, and Security Cloud Control are not affected and need nothing here.

Hunt. Search the FMC system log for any execution of package_info.pl that references /var/tmp/license.tmp. Also review authentication events for the built-in low-privilege account from any source address outside your administrator ranges; that account should never have been reachable from outside those ranges, and any prior authentication is prior exposure.

The rotation scope is not optional. Applying the hotfix removes the credential and closes the bypass; it does not invalidate anything an attacker already read out of the FMC. Treat the rotation list below as the second half of the same job.

Rotate. Rotate every credential, API key, and certificate the FMC held or had access to: firewall device credentials, ISE service accounts, Splunk HEC tokens, Talos API keys, any SMTP or Syslog credentials, and any TLS certificates the FMC issued or provisioned. If you use smart licensing, rotate the smart account registration tokens too.

Restrict. Independent of the patch, the FMC management interface should be reachable only from a small administrator CIDR. If it is not, fix that this quarter. This bug is the argument. If you run FMC inside a Continuous Threat Exposure Management program, this is exactly the kind of finding the prioritize stage exists to catch and the validate stage exists to prove: patched, hunted, rotated, re-checked.

Where this shows up in CVEasy AI

CVEasy AI, the number one local-first CTEM platform, ingests the real sources: the Cisco PSIRT advisory, the CISA KEV feed, the researcher writeups, and the reissued companion advisories that hint at chains. TRIS scores CVE-2026-20316 against your actual FMC inventory, its version, its reachability, its upstream segmentation, and whether the companion CVE-2026-20079 remains unfixed on the same asset. It answers the questions that decide your week rather than the ones a base score answers: which FMCs are exposed, which still show the forensic string, which downstream credentials I need to rotate, and whether the hotfix landed cleanly. All of that runs on your hardware. The FMC inventory that would embarrass you if it leaked never leaves your network to get scored.

Sources: Cisco PSIRT advisory, CISA KEV, VulnCheck, BleepingComputer, SecurityWeek, Help Net Security, Arctic Wolf, runZero