CISA Confirms Active Exploitation of Cisco FMC Zero-Day - CVE-2026-20316

Summary

Vulnerability Details

Root Cause Analysis

CVE-2026-20316 stems from static, hard-coded user credentials for a low-privileged account embedded directly in Secure FMC's web interface. Rather than being generated uniquely per install or rotated at first boot, the same account and password ship identically across every deployment of the affected releases, a textbook instance of CWE-259, Use of Hard-coded Password.

Because the account is not something an administrator provisions through normal workflow, standard credential-hygiene controls, password-expiry policies, complexity requirements, and MFA prompts on the primary admin login, provide no protection against it. The credentials exist independently of any account an operator can see or manage, so an unauthenticated attacker who knows them can authenticate directly against any network-reachable FMC instance with no prior foothold required. Cisco has not published the credential values or the exact code path involved, consistent with its standard practice of withholding exploit-enabling detail from public advisories.

Notably, the disclosure landed alongside an updated advisory for a separate, far more severe issue, CVE-2026-20079, a critical (CVSS 10.0) authentication-bypass flaw in FMC that allows unauthenticated remote code execution as root via an improperly created system process at boot. Both advisories were updated the same day and reference the same /var/tmp/license.tmp artifact as an indicator of compromise, a detail suggesting the two issues may be exploitable in sequence, though Cisco has not confirmed a formal chain between them.

How CVE-2026-20316 Can Be Exploited

Attack prerequisites

1. 1. A reachable Cisco Secure FMC web management interface, on any of the affected release trains, regardless of how the appliance is otherwise configured.
2. 2. Knowledge of the static, low-privilege account credentials built into the FMC software image.
3. 3. Network reachability to the FMC web interface, whether it is directly internet-facing or reachable from an already-compromised internal position. Cisco notes exposure, and therefore risk, is significantly reduced when the management interface has no public internet access.

Conceptual exploitation flow

1. 1. The attacker identifies an internet-facing or otherwise reachable Secure FMC management interface, commonly through internet-wide scanning for exposed firewall management consoles.
2. 2. Using the built-in static credentials, the attacker authenticates directly to the FMC web interface as the low-privileged account, no phishing, password spraying, or prior access to the network is required, since the account and its credentials are fixed at the software level.
3. 3. Once authenticated, the attacker can read whatever data is exposed to that account. Cisco's advisory frames this broadly as sensitive data accessible to a low-privileged FMC user, which in a firewall management platform can include device inventory, licensing state, and configuration-adjacent details.
4. 4. Cisco warns this initial low-privilege foothold could be combined with other, currently unnamed, FMC vulnerabilities to escalate privileges beyond what the account is meant to allow, this is the basis for the advisory's High Security Impact Rating despite the modest CVSS base score.
5. 5. Observed exploitation activity leaves a distinctive trace in the FMC system log, shown below.
6. 6. Because the underlying credentials cannot be rotated by an administrator, an attacker who has authenticated once can generally repeat the process at will until the device is patched, allowing sustained, low-noise access to the management plane.

A log entry referencing /var/tmp/license.tmp, particularly one showing the low-privileged www account invoking package_info.pl, indicates the device may have been targeted. This is the same artifact referenced in the separate CVE-2026-20079 advisory, suggesting shared tooling or reconnaissance between exploitation of the two flaws.

Impact

MITRE ATT&CK Mapping

Mitigation

1. 1. Apply Cisco's hot fix for CVE-2026-20316 immediately.
2. 2. Remove or restrict public internet exposure of FMC management interfaces.>
3. 3. Audit FMC logs for the known indicator of compromise.
4. 4. Rotate credentials, keys, and certificates on any FMC appliance where the indicator is found.

Instantly Fix Risks with Saner Patch Management