A Shipped-In Password on the Box That Runs the Firewalls: CVE-2026-20316

Cisco Secure Firewall Management Center is the console that governs a whole fleet of firewalls. It shipped with a static login for a low-privileged account, and an unauthenticated attacker can use it to read sensitive data straight out of the appliance. Cisco says it is already being exploited in the wild, CISA has put federal agencies on a short clock, and the same indicator of compromise ties it to two more serious FMC flaws.

What the vulnerability is

Cisco Secure Firewall Management Center, formerly Firepower Management Center, is the centralized console for Cisco Secure Firewall (Firepower) appliances. It is where administrators write and push firewall rules, manage policy across many devices at once, run intrusion prevention, and hold the configuration and topology of the protected network. In a large deployment the FMC is not one firewall; it is the single place that governs all of them.

CVE-2026-20316 is a textbook case of what CWE-259, use of hard-coded password, describes: software shipped with a built-in set of credentials that the user cannot easily change or remove. Here the static credentials belong to a low-privileged account exposed through the FMC web-based management interface. As Cisco put it, the flaw is due to the presence of static user credentials for a low-privileged account, and an attacker can exploit it simply by using that account to log in.

The flaw was found and reported by Jimi Sebree of Horizon3.ai. Cisco published its advisory, cisco-sa-fmc-static-cred-BET3Cjh, on July 29, 2026, and released hot fixes the same day.

How the exploit works

There is no clever memory corruption or protocol trickery here, and that is part of why it matters. The appliance ships with a username and password baked into the software. An attacker who can reach the FMC web interface over the network sends those known static credentials to the login, and the appliance accepts them. No valid customer account is needed, and no prior foothold is required. The attacker is now authenticated as the low-privileged user and can read sensitive data visible to that account.

The attacker does not break the lock. The lock was shipped with a spare key taped to the back, and the same key fits every unit.

Two honest limits keep this from being an instant full compromise on its own. The account is low-privileged, so what a single unchained login yields is read access to sensitive data rather than administrative control of the firewall fleet. And, as Cisco notes, the attack surface is reduced when the FMC management interface is not reachable from the public internet. But the more troubling story is chaining. Cisco raised the impact rating to High specifically because this static credential can be combined with other Cisco Secure FMC vulnerabilities to elevate privileges, and the FMC has two serious siblings disclosed earlier in 2026. CVE-2026-20079 is a critical, CVSS 10.0 authentication bypass that Cisco updated the same day, which can let an unauthenticated attacker execute script files and gain root on the underlying operating system. CVE-2026-20131 is a remote code execution flaw, triggered by sending a crafted serialized Java object to the same web management interface, that Amazon's security team reported was exploited as a zero-day by the Interlock ransomware group starting in January 2026. Notably, all three advisories now share the same indicator of compromise, which tells defenders these flaws are being looked at together.

Why an IT security appliance lands on an OT and CI watch

We want to be precise about scope. The FMC is IT security infrastructure, not an industrial control system, and CVE-2026-20316 is not an ICS advisory. We are flagging it under our operational-technology and critical-infrastructure watch for a specific and, we think, defensible reason: the FMC governs the Cisco Secure Firewall appliances that, in a great many utilities, hospitals, water systems, and manufacturers, enforce the segmentation between the enterprise IT network and the operational one. When defenders draw the line that keeps the plant floor separate from email and the internet, a Cisco firewall is frequently the device drawing it, and the FMC is where that line is defined.

That is what makes even low-privileged read access consequential. The FMC holds firewall rules, network topology, address objects, VPN configuration, and the shape of the segmentation itself. An attacker who can read that is handed a map of the defenses: where the OT zone sits, which paths cross into it, and where the weak seams are. That is precisely the reconnaissance a targeted intrusion needs before it moves laterally toward control systems. And if the static login is chained to the auth-bypass or the code-execution flaw on the same box, read access becomes the ability to rewrite rules and quietly remove the very segmentation that was keeping the operational network apart. The family history is the reason to take the chaining seriously, because the FMC RCE sibling was already weaponized by a ransomware crew this year.

What we see from our sensors

We run a fleet of honeypots and edge decoys, and this vulnerability is the kind that sits in our lane: it is reached by sending ordinary network traffic to the web interface of an internet-facing management appliance, which is exactly what our decoys are built to emulate and observe. We run Cisco and similar appliance-style decoys, and we routinely see hundreds of source addresses a day probing at exposed management interfaces.

The observable footprint is concrete. An attacker probing for CVE-2026-20316 first has to find and reach an FMC web interface, so we would expect to see scanning for Cisco Secure Firewall Management Center login pages, followed by login attempts using the static account rather than sprayed or brute-forced passwords. A decoy that presents as an FMC-style management console is well placed to catch that reconnaissance and the tell-tale single-credential login. On real appliances, the log indicator above, the package_info.pl run against /var/tmp/license.tmp, is the artifact to hunt for.

How to fix or mitigate it

The primary fix is to apply Cisco's hot fix, which is the only complete remediation. Cisco released per-train hot fixes on July 29, 2026, and, because active exploitation has been ongoing, urges customers to treat any exposed appliance as potentially touched: check the indicator of compromise, and rotate all user credentials, keys, and certificates on the device rather than assuming the patch alone closes the story.

• Apply the Cisco hot fix. Install the fixed hot fix for your FMC release train (7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.5.1, 7.7.12.1, or 10.0.1.1 and later). This is the only complete remediation. Federal civilian agencies are ordered to remediate by August 1, 2026, and that is a reasonable clock for everyone else.
• Get the management interface off the public internet. Cisco notes the attack surface is reduced when the FMC management interface is not internet-reachable. Restrict it to a dedicated, trusted management network, which also shrinks exposure to the two related FMC flaws.
• Check for the indicator of compromise. Run cat /var/log/messages | grep license in expert mode and look for package_info.pl referencing /var/tmp/license.tmp. The same indicator applies to CVE-2026-20079 and CVE-2026-20131, so treat a hit as relevant to all three.
• Rotate secrets and assume exposure. Because exploitation has been ongoing before the fix, rotate all user credentials, keys, and certificates on the device. If exploitation is suspected, contact the Cisco Technical Assistance Center for recovery options.
• Patch the siblings while you are here. Make sure the critical CVE-2026-20079 authentication bypass and the CVE-2026-20131 RCE are also remediated, since they share the appliance, the interface, and the indicator of compromise, and the static credential is most dangerous when chained.

Indicators and references