CVE-2026-20316 is a hard-coded password vulnerability (CWE-259) in on-premises Cisco Secure Firewall Management Center, the console that administers an organization's entire Secure Firewall estate. Cisco published advisory cisco-sa-fmc-static-cred-BET3Cjh on July 29, 2026, stating that Cisco PSIRT became aware of active exploitation in July 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day with an August 1 federal remediation deadline, a three-day window. The CVSS 3.1 base score is 5.3, but Cisco assigned its own Security Impact Rating of High, above the base score, because the access this flaw grants can be combined with other FMC vulnerabilities to elevate privileges. There is no workaround. Cloud-Delivered FMC and Firewall Device Manager are not affected.
A note on scoring: CVE Brief's pipeline recorded this CVE at 9.5. Cisco, NVD and Tenable all publish 5.3, and 5.3 is what the published vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) computes to. The 5.3 figure is correct and the confidentiality-only impact is real. Treat the urgency as coming from the KEV listing, the three-day deadline, and Cisco's own High rating, not from the base score.
Am I vulnerable?
If you run an on-premises FMC appliance or virtual instance on any supported train, assume yes until you have confirmed a hotfix is installed. The credential is embedded in the FMC web interface. It is not a setting, so no configuration you have applied makes you safe.
The version-checking trap: Cisco shipped this fix as hotfix packages layered on top of the last release in each train, not as new release numbers. An appliance reporting 7.4.7 is still vulnerable unless hotfix HG-7.4.7.1-3 is installed. Check for the hotfix, not just the version.
Affected versions
| Train |
Vulnerable below |
Fixed by hotfix |
| 10.0 |
10.0.1.1 + hotfix |
Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2 |
| 7.7 |
7.7.12.1 + hotfix |
Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2 |
| 7.6 |
7.6.5.1 + hotfix |
Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2 |
| 7.4 |
7.4.7.1 + hotfix |
Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3 |
| 7.3 |
all versions |
none published |
| 7.2 |
7.2.11.1 + hotfix |
Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4 |
| 7.0 |
7.0.9.1 + hotfix |
Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3 |
Not affected: Cloud-Delivered FMC (cdFMC), Firewall Device Manager (FDM), Secure Firewall ASA, Secure Firewall Threat Defense (FTD), and Security Cloud Control.
The 7.3 train (7.3.0 through 7.3.1.2) appears in the affected enumeration, but Cisco's hotfix table publishes no 7.3 package. Cisco does not address the gap in the advisory text. If you run 7.3, confirm the upgrade path with Cisco TAC rather than assuming a hotfix is pending.
Diagnostic commands
All four are read-only.
- FMC CLI (SSH or console):
show version. Returns model, version and build. Compare against the table above, then confirm the hotfix separately.
- FMC web UI: Help > About for the version, then System > Updates > Product Updates to confirm whether the matching hotfix package (GB, HL, HG, CY, AM or P series) is listed as installed.
- REST API, for sweeping a fleet:
GET /api/fmc_platform/v1/info/serverversion with a token from /api/fmc_platform/v1/auth/generatetoken. Returns serverVersion alongside VDB, LSP and SRU versions. Authenticates as an existing admin account and changes nothing.
- Compromise triage, from FMC expert mode:
cat /var/log/messages | grep license. This is Cisco's own published indicator, covered under Detection below.
Vulnerability
The bug class is CWE-259, use of a hard-coded password. Cisco ships FMC with a static account credential in the web interface. Because the credential is baked into the software rather than generated per install, it is identical across every unpatched appliance, and anyone who extracts it from one image holds a working login for all of them. The CVSS vector is AV:N/AC:L/PR:N/UI:N: network reachable, low complexity, no privileges, no user interaction. Cisco tracks the issue as bug ID CSCwt95997 and credits Jimi Sebree of Horizon3.ai with reporting it, per Cisco's advisory acknowledgements as reported by BleepingComputer and Help Net Security.
The impact metrics are narrow and worth reading literally: C:L/I:N/A:N. The account is low-privileged. On its own this flaw grants an attacker a read view of what that account can see, with no write access and no ability to disrupt the appliance. That is why the base score lands at 5.3.
Cisco's own severity rating tells the other half of the story. Cisco rated the advisory High, explicitly stating that the access can be combined with other Cisco Secure FMC vulnerabilities to elevate privileges. Cisco did not name which ones. SOC Prime's analysis points to the separate FMC authentication bypass CVE-2026-20079 as the escalation partner, on the basis that both touch the same /var/tmp/license.tmp artifact; BleepingComputer describes that connection as unclear, and Cisco has not confirmed it. Cisco's published exploitation indicator is consistent with real-world activity going past the low-privileged read: the log signature shows the web service account (www) running a Secure Firewall system binary as root.
Tenable records an EPSS score of 0.00788, roughly a 0.8 percent 30-day exploitation probability. That is a useful illustration of a known limitation rather than a reason to deprioritize: EPSS is a statistical model that lags confirmed in-the-wild activity on freshly disclosed appliance flaws, and this CVE was KEV-listed on the day it was published.
Threat model
Who would exploit this: The credential is remotely reachable, needs no privileges and no user interaction, and once extracted from an image it is reusable against every unpatched appliance, so it is available to any operator category from commodity scanners upward. The profile that best fits the observed activity is a capable targeted actor: exploitation began before a fix existed, and on-premises FMC is a security management plane rather than a consumer-facing service. Initial-access brokers and state-aligned operators are the categories most consistent with that economics, with opportunistic ransomware affiliates a secondary risk once the credential circulates publicly. Cisco and CISA published no attribution, so this is category reasoning and not an actor claim.
What they're after:
- Reconnaissance and collection of the data exposed to the low-privileged account, the only outcome this CVE alone guarantees
- A foothold on the management plane, staged for privilege escalation by chaining to other FMC vulnerabilities
- Persistence on an appliance with limited endpoint visibility, implied by Cisco instructing customers to rotate all credentials, keys and certificates after exploitation
- Lateral movement into managed FTD devices and integrated identity and logging systems, reachable only after a successful escalation
- Data exfiltration of policy, VPN and traffic telemetry at scale, which likewise requires the escalation step
Attack chain: An attacker identifies reachable FMC web management interfaces, then authenticates with the embedded static account, requiring no organization-issued credentials. That session yields read access to whatever the low-privileged account can see, which is reconnaissance value against the security architecture rather than control of it. In a realistic campaign the operator treats this as the entry step and pivots to a second FMC weakness to reach higher privileges on the underlying operating system, which is the escalation path Cisco cited when it rated the advisory High.
Blast radius: FMC is the centralized console for a Secure Firewall estate, so a fully compromised instance exposes the material that describes the network's defenses: access policies that map internal segmentation, VPN configuration, IPS tuning, credentials for managed FTD devices, and the event and traffic telemetry those devices report. Adjacent systems inherit the exposure, including AD or LDAP used for FMC administrator authentication, RADIUS or ISE integrations, and syslog or SIEM pipelines that FMC feeds. This CVE on its own does not deliver that estate-wide outcome, since its confidentiality impact is rated Low and it grants no write access, so treat the full blast radius as the consequence of a successful chain and the low-privileged read as credible early-stage reconnaissance toward it.
Mitigation
Patch
The hotfix is the only complete remediation. Cisco published packages per train as .sh.REL.tar files, listed in the affected-versions table above. Install the package matching your train on top of the base release named in the filename. Federal agencies were given until August 1, 2026 under CISA BOD 26-04.
The 7.3 train has no published hotfix. Plan a migration to a fixed train and confirm the path with Cisco TAC.
Configuration mitigation
Cisco states verbatim that there are no workarounds that address this vulnerability. The credential is embedded in the web interface and cannot be disabled, changed or configured away by the operator. Any network-level restriction below is a risk-reduction measure, not a vendor-sanctioned workaround.
Post-exploitation credential rotation
Cisco directs customers to rotate all user credentials, keys and certificates on the FMC appliance, not only the static account, because exploitation has been ongoing and a foothold combined with chained FMC flaws may have exposed stored secrets. Because FMC holds credentials for the devices it manages, scope the rotation to include managed-device credentials and any integration secrets (RADIUS, LDAP bind accounts, SIEM forwarders, API tokens), not just FMC logins. If you suspect exploitation, Cisco directs you to contact Cisco TAC for recovery assistance.
Compensating controls
- Confirm the FMC management interface is not reachable from the internet. An internet-exposed FMC is directly exploitable with no privileges, and Cisco notes the attack surface is reduced when it is not publicly reachable.
- Restrict management-interface access to a dedicated out-of-band management subnet with an explicit allowlist of administrator source addresses, enforced upstream of the appliance rather than on it.
- Confirm FMC is streaming audit logs off the appliance to a SIEM. Local logs rotate and can be tampered with, and appliance telemetry is frequently the last thing a SOC has retained when it needs to answer how far back the activity goes.
- Baseline the small, stable set of source IPs and User-Agent strings that legitimately drive the FMC REST API, so that anything else stands out.
Detection (starter rules, validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.
Cisco's own indicator is the highest-value signal here: from FMC expert mode, run cat /var/log/messages | grep license. Cisco states that a log message referencing /var/tmp/license.tmp may indicate the vulnerability was exploited on the device. The published sample line is:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
Because /var/log/messages rotates and an attacker with root can clean it, a negative result is not proof of no compromise. Check rotated copies too.
Network and log signals
- Any reference to
/var/tmp/license.tmp (creation, read or removal) outside a genuine Smart Licensing registration or upgrade window, particularly when no corresponding administrator action appears in System > Monitoring > Audit at the same timestamp.
- Successful FMC web UI (HTTPS/443) or REST API authentication from a source IP outside the designated out-of-band management subnet, and above all from any internet-routable source. A single successful login from an unexpected prefix is a high-value signal on its own.
- REST API token requests to
/api/fmc_platform/v1/auth/generatetoken from unrecognised User-Agent strings (curl, python-requests, Go-http-client, empty UA) or from client IPs with no history of automation against the appliance.
- Authentication succeeding for an account name absent from your provisioned user inventory (System > Users, plus any external RADIUS, LDAP or SAML mappings). Alert on first-time-seen username plus source IP combinations rather than on any specific name.
- A first-time-seen session immediately pulling device inventory and policy data (
/api/fmc_config/v1/domain/*/devices/devicerecords, .../policy/accesspolicies, object and network group reads), or a rapid run of audit Page View actions across System and Policies subsystems, especially off hours.
- An unexplained gap or stop in FMC audit streaming to the SIEM, which can indicate tampering or a disabled syslog destination.
YARA
Scoped to offline triage of exported FMC logs, troubleshoot bundles and backups on an analyst workstation. A network authentication abuse against an appliance leaves nothing scannable on defender-controlled hosts, so do not expect this to fire during ordinary endpoint scanning.
rule CVE_2026_20316_FMC_LicenseTmp_Root_Escalation_Artifact
{
meta:
description = "AI-generated starter rule. Flags Cisco's published CVE-2026-20316 indicator inside COLLECTED (offline) Cisco Secure FMC artifacts: a sudo entry showing the web service account running /usr/local/sf/bin/package_info.pl against /var/tmp/license.tmp as root. Intended for scanning exported /var/log/messages copies, FMC troubleshoot bundles, and configuration or system backups on an analyst workstation, NOT for live scanning of a production appliance."
author = "CVE Brief (AI-generated starter rule, validate before deploying)"
date = "2026-07-31"
cve = "CVE-2026-20316"
reference = "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-fmc-static-cred-BET3Cjh.html"
scope = "offline artifact triage"
confidence = "medium"
note = "Contains no credential material and no unverified file hashes. Positive hits are not proof of compromise: the same helper can run during legitimate licensing and upgrade work."
strings:
$script = "/usr/local/sf/bin/package_info.pl" ascii
$tmpfile = "/var/tmp/license.tmp" ascii
$sudo_tag = "sudo:" ascii
$as_root = "USER=root" ascii
$web_user = "www :" ascii
$lsm_flag = "--lsm" ascii
condition:
filesize < 500MB
and $script
and $tmpfile
and 2 of ( $sudo_tag, $as_root, $web_user, $lsm_flag )
}
Sigma
title: Possible Cisco Secure FMC Static Credential Exploitation (CVE-2026-20316)
id: 7b2f4c19-3a6d-4e58-9c21-8d5f0ab6e743
status: experimental
description: |
AI-generated starter rule. Detects Cisco's published indicator of compromise for CVE-2026-20316,
a static (hard-coded) credential flaw in Cisco Secure Firewall Management Center that is listed in
the CISA KEV catalog and was exploited as a zero day. Cisco directs administrators to run
"cat /var/log/messages | grep license" in expert mode and to treat execution of
/usr/local/sf/bin/package_info.pl against /var/tmp/license.tmp as possible exploitation. The rule
also flags the broader behaviour of the FMC web service account escalating to root to run Secure
Firewall system binaries. It matches on forwarded raw syslog text, so it works without any
vendor specific parser. No credential material is referenced.
author: CVE Brief (AI-generated starter rule, validate in your environment before deploying)
date: 2026/07/31
references:
- https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-fmc-static-cred-BET3Cjh.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-20316
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
- attack.initial-access
- attack.t1078.001
- attack.privilege-escalation
- attack.t1548.003
- cve.2026.20316
logsource:
product: cisco
service: fmc
definition: |
Syslog forwarded from a Cisco Secure Firewall Management Center appliance, covering both
/var/log/messages system logging and the streamed FMC audit log (messages carry an optional
bracketed tag such as [FMC-AUDIT-LOG] and the form
"Date Time Host: [Tag] Sender: User_Name@User_IP, Subsystem, Action").
The field name "message" is an assumed normalisation for the raw syslog text and should be
remapped to your pipeline's equivalent (for example _raw, msg, rawmessage, or
cisco.fmc.message).
detection:
selection_cisco_ioc:
message|contains|all:
- 'package_info.pl'
- '/var/tmp/license.tmp'
selection_web_account_to_root:
message|contains|all:
- 'sudo:'
- 'USER=root'
- '/usr/local/sf/bin/'
message|contains:
- 'www :'
- 'www:'
filter_maintenance:
message|contains:
- 'Backup Restore'
- 'Log Replay'
condition: (selection_cisco_ioc or selection_web_account_to_root) and not filter_maintenance
fields:
- message
- host
- src_ip
- user
falsepositives:
- Cisco TAC directed troubleshooting or expert mode maintenance that legitimately invokes package_info.pl.
- Smart Licensing registration, entitlement refresh, FMC software upgrades, and hotfix installation, all of which touch temporary files under /var/tmp and run Secure Firewall system binaries as root.
- Re-ingestion or replay of historical FMC logs into the SIEM, and restoration of an old backup, which can resurface the indicator long after the fact.
- Vulnerability scanners, purple team tooling, or validation scripts that write the indicator strings into logs while testing for this CVE.
- Local shell parsing conventions where a hostname or path unrelated to FMC happens to contain the matched substrings.
level: high
Rule notes
Both rules key on Cisco's own published post-exploitation indicator rather than on the static credential itself, which is deliberate: detecting on the secret would require publishing it. The Sigma field name message and the product: cisco / service: fmc logsource pair are assumed normalisation conventions rather than a vendor-documented schema, so remap them to your pipeline's raw message field. The indicator appears to be shared with the CVE-2026-20079 authentication bypass, so a hit proves appliance compromise activity but not which flaw was used. An absence proves nothing, because the low-privileged read-only access this CVE grants can be exercised without ever touching license.tmp. Pair the rules with the source IP and account anomaly signals above.
References