A static credentials vulnerability (CVE-2026-20316) in Cisco Secure Firewall Management Center (FMC), a platform for centrally managing multiple Cisco Secure Firewall devices across a network, is being leveraged by attackers, CISA warned.
Two FMC flaws, one indicator of compromise
CVE-2026-20316, reported by Jimi Sebree of Horizon3.ai, is found in the FMC software’s web interface. The static user credentials are for a low-privileged account, and they can be used by attackers to log in to an affected device and potentially access sensitive data.
Cisco noted that it could also be leveraged in conjunction with other vulnerabilities, potentially allowing attackers to gain elevated privileges and thus greater capacity for more in-depth compromise. (The company did not say such chaining was actually occurring.)
The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday, ordering US civilian federal agencies to address the flaw by August 1, 2026, and to check whether the vulnerability has been exploited on their installations.
Cisco says its Product Security Incident Response Team became aware of active exploitation of this vulnerability this month, and has provided hotfixes.
It has also provided instructions on how to check for indicators of compromise (IoCs) in the system log – the presence of package_info.pl execution referencing /var/tmp/license.tmp indicates possible exploitation.
“If exploitation is suspected, contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. At a minimum, Cisco recommends that customers rotate all user credentials, keys, and certificates on the Cisco Secure FMC device because active exploitation of this vulnerability has been ongoing,” the company advised<. Cisco published the same IoC check in a separate advisory, updated the same day, for a related FMC flaw. That one is for CVE-2026-20079, which was disclosed in March 2026 after getting flagged by Cisco during internal security testing and, according to the updated advisory, it may allow unauthenticated attackers to “bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.”
However, the company says that its incident response team is not aware of any public announcements or malicious use of CVE-2026-20079.
Cisco FMC in attackers’ sights
Cisco’s networking and security devices and solutions are often compromised via known and zero-day vulnerabilities, but Cisco Secure Firewall Management Center had not become a popular target until recently.
In March 2026, Cisco disclosed two critical FMC vulnerabilities: the CVE-2026-20079 authentication bypass mentioned above, and CVE-2026-20131, a remote code execution flaw exploited by sending a crafted serialized Java object to a vulnerable device’s web-based management interface. Soon after, Amazon CISO CJ Moses revealed that the company’s honeypots had detected the Interlock ransomware gang exploiting the latter as a zero-day, beginning January 26, 2026.
FMC’s web-based management interface is the weak point attackers have been passing through.
“If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced,” Cisco noted in the advisories for all three FMC vulnerabilities.