Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.

The vulnerability is caused by static credentials for a low-privilege account built into Cisco Secure FMC Software.

Cisco says an unauthenticated, remote attacker can use these credentials to log in to an affected system and access sensitive data available to the account.

While CVE-2026-20316 has a CVSS score of 5.3, Cisco assigned it a High severity rating because the access can be combined with other FMC vulnerabilities to elevate privileges.

However, the company has not identified the additional vulnerabilities or explained how they are being used in attacks.

The flaw affects Cisco Secure FMC Software regardless of device configuration, but does not impact Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, or Security Cloud Control.

Cisco has released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds that address the vulnerability, and customers are strongly advised to install the available fixes.

Cisco says it became aware of active exploitation in July 2026 but has not shared when the attacks began, who is behind them, or what organizations were targeted. Jimi Sebree of Horizon3.ai reported the vulnerability.

The company notes that the attack surface is reduced when the FMC management interface is not exposed to the public internet.

To detect whether a Cisco FMC installation was compromised, administrators should review the /var/log/messages log file for signs that the vulnerability may have been exploited.

Administrators can search for suspicious activity by running the following command in expert mode:

cat /var/log/messages | grep license
Cisco says a log entry containing /var/tmp/license.tmp, as shown below, may indicate that an FMC device was compromised:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
The log entry shows the FMC web process, running under the www account, invoking Cisco's package_info.pl script as root and supplying the /var/tmp/license.tmp file.

If a device contains this IOC, admins should rotate all user credentials, keys, and certificates on the affected FMC device because exploitation has been ongoing.

Organizations that believe they are compromised should also contact the Cisco TAC for assistance with recovery.

Critical FMC authentication bypass flaw also patched

Cisco also updated an advisory for a separate critical FMC authentication bypass vulnerability tracked as CVE-2026-20079, which has a maximum CVSS score of 10.0.

The flaw allows an unauthenticated, remote attacker to bypass authentication and execute scripts and commands as root by sending specially crafted HTTP requests to an affected FMC device.

Cisco says the vulnerability is caused by an improper system process created when the system boots.

Unlike CVE-2026-20316, CVE-2026-20079 does not require credentials or prior access to the device.

Cisco originally disclosed CVE-2026-20079 in March 2026 and updated the advisory on July 29 to add a second bug ID, hot fixes, and indicators of compromise.

However, Cisco says it is not aware of malicious exploitation of this vulnerability.

The company published the same /var/tmp/license.tmp indicator in both advisories, but has not explained whether the vulnerabilities are connected.

Furthermore, Cisco's description of CVE-2026-20079 indicates that it can be exploited without using the static credentials associated with CVE-2026-20316 to achieve root access.

Cisco has released the same Secure FMC hot fixes for CVE-2026-20079 and says there are no workarounds that fully address the vulnerability.

BleepingComputer contacted Cisco to clarify whether the vulnerabilities are connected, whether CVE-2026-20079 has also been exploited, and whether the shared indicator was added to both advisories intentionally.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper