Cisco FMC CVE-2026-20316: the hard-coded credential problem that will not go away

CVE-2026-20316 is a use-of-hard-coded-password vulnerability in the Cisco Secure Firewall Management Center (FMC) web interface. A static low-privilege account is built into the software. A remote unauthenticated attacker can authenticate using this account and access sensitive configuration data. Cisco confirmed active exploitation on July 29, 2026. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog the same day, with an FCEB remediation deadline of August 1.

There is no workaround. If you run Cisco FMC, apply the hot fix for your release train (7.0, 7.2, 7.4, 7.6, 7.7, or 10.0) now.

The CVSS number is misleading

The base CVSS score is 5.3, which would normally place this in the medium-severity category. Cisco rates it SIR High because the hard-coded account can be chained with other FMC vulnerabilities to achieve privilege escalation beyond the low-privilege initial access. CISA's inclusion in KEV, which is reserved for vulnerabilities with confirmed active exploitation, overrides the CVSS framing: if active exploitation is confirmed, the practical risk is not medium, regardless of what the score says.

To check whether your FMC has been compromised: in expert mode, run cat /var/log/messages | grep license. If the output contains references to /var/tmp/license.tmp, the device may have been accessed via the hard-coded account. This is the detection indicator Cisco provided in its advisory.

Hard-coded credentials in security products: a recurring pattern

This is not the first time a security appliance has shipped with a built-in credential that became an exploitation vector. The pattern appears regularly: Fortinet (CVE-2022-40684, CVE-2023-27997), SolarWinds, Zyxel, and now Cisco FMC. The common thread is that credentials embedded in firmware or software for debug, recovery, or feature-specific purposes accumulate over product lifetimes and are not always removed before shipping.

For defenders, the implication is that security appliances are not exempt from the authentication hygiene standards applied to other infrastructure. Management interfaces for firewalls, VPN gateways, and security management platforms should be subject to the same zero-trust access controls as any other high-privilege service: not internet-accessible by default, authenticated with non-static credentials, and monitored for anomalous access patterns.

Patch priority today

If your organization is a US federal agency, the FCEB deadline is August 1. If you are not a federal agency, the presence of active exploitation means the timeline is the same in practice. Cisco FMC manages firewall policy for your entire environment. An attacker with access to FMC can modify firewall rules, exfiltrate configuration, and use the management plane as a pivot point for lateral movement. Treat this as an emergency patch item regardless of whether your FMC is internet-accessible.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are working through a Cisco FMC remediation or have questions about firewall management-plane security posture.