The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed flaw in Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog. The update follows reports that the Cisco FMC zero-day is being actively exploited in the wild.
Security researchers and Cisco both point to a design weakness that makes the problem especially dangerous: attackers may not need advanced access to make the breach happen. Instead, the vulnerability is tied to static user credentials for a low-privileged account, which can enable remote login and access to sensitive data.
What the Cisco FMC zero-day allows attackers to do
Under the vulnerability identifier CVE-2026-20316 (CVSS score 5.3), an unauthenticated remote attacker may be able to log into an affected Cisco Secure FMC device using a low-privilege account. Once logged in, the attacker could reach confidential information stored or exposed within susceptible systems.
Cisco attributed the issue to the presence of static credentials tied to a low-privileged user account. In practical terms, if a threat actor knows or can obtain those credentials, they can attempt authentication and gain the ability to view sensitive data under the context of that account.
Why public exposure matters
Not every environment faces the same level of risk. Cisco noted that the associated attack surface is reduced when the FMC management interface is not reachable from the public internet. In other words, network architecture and access control can significantly influence whether remote attackers can reach the management component that contains the flaw.
That said, the fact that CISA categorized the bug as known exploited means defenders should assume real-world attempts are occurring, even if they have not yet been detected internally.
Impact rating increased due to possible chaining
Even though CVE-2026-20316 carries a CVSS score of 5.3, Cisco assigned it a Security Impact Rating (SIR) of High rather than Medium. The company’s reasoning is that the weakness can potentially be chained with other Cisco Secure FMC Software vulnerabilities to increase privileges.
This matters because attackers frequently combine multiple bugs. A low-to-mid severity issue can become far more damaging when used as a stepping stone toward higher privilege access.
Who discovered it and when exploitation began
Security researcher Jimi Sebree of Horizon3.ai is credited with discovering and reporting the flaw. Cisco also acknowledged that the vulnerability was being actively exploited earlier in the month, but the company did not publicly specify when the attacks started, who is behind them, or the exact techniques currently being used.
For defenders, that uncertainty is a warning sign: monitoring and rapid patching become even more important when the exploitation path is not fully known.
Fixed in hotfix versions of Cisco Secure FMC Software
Cisco has released hotfix updates to remediate CVE-2026-20316. If your organization runs one of the affected software lines, you should move to one of the following versions:
- 7.0 – Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
- 7.2 – Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
- 7.4 – Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
- 7.6 – Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
- 7.7 – Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
- 10.0 – Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar
Because this is a KEV-listed vulnerability, you should treat the update as urgent. For U.S. Federal Civilian Executive Branch (FCEB) agencies, Cisco’s guidance aligns with a target to apply fixes by August 1, 2026.
How to check for signs of compromise (IoC guidance)
Cisco is also urging customers to run a specific command to look for an indicator of compromise (IoC). The guidance targets a file path associated with potentially suspicious license handling activity.
Run the following CLI command in expert mode:
cat /var/log/messages | grep license
If the output includes /var/tmp/license.tmp, there is a possibility that the Cisco Secure FMC device may have been affected by exploitation attempts related to CVE-2026-20316.
Cisco provided an example snippet showing how the indicator could appear in logs. While the exact timestamps and log formatting may differ across environments, the key point is whether that /var/tmp/license.tmp reference shows up in your messages.
Connection to another critical flaw: CVE-2026-20079
Alongside the KEV addition for CVE-2026-20316, Cisco updated its advisory for CVE-2026-20079 (CVSS score 10.0), a critical authentication bypass affecting Cisco Secure FMC Software.
Cisco added a second bug identifier to that advisory: CSCwt95974. The update also includes the same IoC indicator (/var/tmp/license.tmp) and hotfix information.
Although Cisco stated it is not aware of malicious exploitation of CVE-2026-20079, the overlap in indicators suggests that threat actors could potentially chain the two vulnerabilities. Cisco described CVE-2026-20079 as enabling execution of arbitrary executable script files to obtain root access, which would significantly increase attacker control.
Even if you only plan to start with the newest KEV item, this linkage reinforces the need to assess your systems holistically and ensure you are current across related advisories.
Recommended next steps for defenders
If you manage Cisco Secure FMC deployments, a practical response plan can look like this:
- Patch promptly to one of the listed hotfix versions for CVE-2026-20316.
- Validate exposure of the management interface. Limiting public internet access can reduce risk, but does not remove the need for remediation.
- Search logs for the IoC by running the suggested CLI command and checking whether /var/tmp/license.tmp appears.
- Review related advisories, especially the updated guidance for CVE-2026-20079 and CSCwt95974.
- Monitor for follow-on activity, since chaining scenarios can turn a modest bug into a larger compromise.
Why this Cisco FMC zero-day deserves immediate attention
The key reason the Cisco FMC zero-day is so concerning is its exploitability. Rather than relying on complex exploitation chains by itself, the flaw centers on static credentials for a low-privileged account. That approach can shorten attacker time-to-access and makes credential-based misuse a central risk.
With CISA treating the issue as known exploited and Cisco warning about potential chaining that could escalate privileges, waiting is not a safe option. The fastest path to risk reduction is applying the available hotfixes and confirming that your environment does not show the referenced indicator.
Conclusion
CISA’s KEV update confirms that the Cisco FMC zero-day tracked as CVE-2026-20316 is more than a theoretical threat. By enabling remote login using static low-privilege credentials, the vulnerability may expose sensitive data—especially in environments where attackers can reach the management interface.
Update to the appropriate hotfix versions, check logs for /var/tmp/license.tmp, and account for possible links to other critical Cisco Secure FMC issues. Taking these steps now can help prevent attackers from moving from initial access toward wider compromise.
Source: https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html
