Cisco’s Secure Firewall Management Center, the console many enterprises use to administer their entire firewall fleet, shipped with a low-privilege account and a hardcoded password baked into its own web interface. Cisco confirmed on July 29 that attackers are already using it.
The flaw, tracked as CVE-2026-20316, lets an unauthenticated remote attacker log into an affected FMC system using static credentials and pull sensitive data available to that account. Cisco rated it High severity, above what its 5.3 CVSS base score would suggest, because the access can be chained with other FMC weaknesses to escalate privileges. In its advisory, Cisco said its Product Security Incident Response Team became aware of active exploitation of the vulnerability in July 2026; CISA has since added it to the Known Exploited Vulnerabilities catalog. Every version of on-premises FMC software is affected; cloud-delivered FMC, Firewall Device Manager, ASA, Threat Defense, and Security Cloud Control are not.
The detail worth flagging for a SOC: Cisco offers no workaround, only hotfixes across the FMC 7.0 through 10.0 release lines, and recommends rotating credentials, keys, and certificates as a baseline recovery step even after patching, because a static account cannot be trusted once its password is public. That is a familiar problem for the security stack. CyberTech covered an authentication bypass in Check Point’s SmartConsole management platform exploited in the wild just weeks earlier, another case where the tool built to secure the network became the entry point into it. Firewall managers sit on nearly every privileged network segment; when their own access control breaks, the blast radius is every device they administer.
Security teams running Secure FMC should apply the hotfix for their release line immediately, check FMC’s expert-mode logs for entries referencing /var/tmp/license.tmp, a Cisco-documented exploitation indicator, and rotate any credentials the management console had access to.
Source: Cisco
