Cisco FMC static credential vulnerability exploited as a zero-day

nyku1 pts0 comments

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

Home / Cisco Security / Security Advisories

Cisco Security Advisory

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

-->

Cisco Security Advisory

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

High

Advisory ID:

cisco-sa-fmc-static-cred-BET3Cjh

First Published:

2026 July 29 16:00 GMT

Version 1.0:

Final

Workarounds:

No workarounds available

Cisco Bug IDs:

CSCwt95997

CVE-2026-20316

CWE-259

CVSS Score:

Base 5.3Click Icon to Copy Verbose Score

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X

CVE-2026-20316

CWE-259

Download CSAF

Email

Summary

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.

Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:<br>https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

Affected Products

Vulnerable Products

This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.

For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

Cisco has confirmed that this vulnerability does not affect the following Cisco products:

Cloud-Delivered FMC (cdFMC)

Firewall Device Manager (FDM)

Secure Firewall Adaptive Security Appliance (ASA) Software

Secure Firewall Threat Defense (FTD) Software

Security Cloud Control (SCC), formerly Defense Orchestrator

Indicators of Compromise

To determine if this vulnerability may have been exploited, use the cat /var/log/messages | grep license CLI command in expert mode. If the log message in the output includes /var/tmp/license.tmp , as shown in the following example, this vulnerability may have been exploited on the Cisco Secure FMC device:

expert<br>admin@firepower:~$ sudo su<br>Password:<br>Last login: Thu Jul 23 19:40:57 UTC 2026 on pts/2<br>root@firepower:/home/admin#<br>root@firepower:/home/admin# cat /var/log/messages | grep license<br>Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

If exploitation is suspected, contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. At a minimum, Cisco recommends that customers rotate all user credentials, keys, and certificates on the Cisco Secure FMC device because active exploitation of this vulnerability has been ongoing.

Workarounds

There are no workarounds that address this vulnerability.

Fixed Software

Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

Cisco Secure FMC Hot Fixes

Cisco has released the following hot fixes to address this vulnerability. Customers can download the hot fixes from the Software Center on Cisco.com.

Cisco Secure FMC Software Release<br>Hot Fix Name

7.0<br>Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar

7.2<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar

7.4<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar

7.6<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar

7.7<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar

10.0<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

For details about downloading and installing these hot fixes, see Cisco Firepower Hot Fix Release Notes.

The Cisco Product Security Incident Response Team (PSIRT)...

cisco vulnerability software secure security advisory

Related Articles