Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Home / Cisco Security / Security Advisories
Cisco Security Advisory
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
-->
Cisco Security Advisory
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
High
Advisory ID:
cisco-sa-fmc-static-cred-BET3Cjh
First Published:
2026 July 29 16:00 GMT
Version 1.0:
Final
Workarounds:
No workarounds available
Cisco Bug IDs:
CSCwt95997
CVE-2026-20316
CWE-259
CVSS Score:
Base 5.3Click Icon to Copy Verbose Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
CVE-2026-20316
CWE-259
Download CSAF
Summary
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:<br>https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
Affected Products
Vulnerable Products
This vulnerability affects Cisco Secure FMC Software, regardless of device configuration.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
Cloud-Delivered FMC (cdFMC)
Firewall Device Manager (FDM)
Secure Firewall Adaptive Security Appliance (ASA) Software
Secure Firewall Threat Defense (FTD) Software
Security Cloud Control (SCC), formerly Defense Orchestrator
Indicators of Compromise
To determine if this vulnerability may have been exploited, use the cat /var/log/messages | grep license CLI command in expert mode. If the log message in the output includes /var/tmp/license.tmp , as shown in the following example, this vulnerability may have been exploited on the Cisco Secure FMC device:
expert<br>admin@firepower:~$ sudo su<br>Password:<br>Last login: Thu Jul 23 19:40:57 UTC 2026 on pts/2<br>root@firepower:/home/admin#<br>root@firepower:/home/admin# cat /var/log/messages | grep license<br>Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
If exploitation is suspected, contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. At a minimum, Cisco recommends that customers rotate all user credentials, keys, and certificates on the Cisco Secure FMC device because active exploitation of this vulnerability has been ongoing.
Workarounds
There are no workarounds that address this vulnerability.
Fixed Software
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Cisco Secure FMC Hot Fixes
Cisco has released the following hot fixes to address this vulnerability. Customers can download the hot fixes from the Software Center on Cisco.com.
Cisco Secure FMC Software Release<br>Hot Fix Name
7.0<br>Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0<br>Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar
For details about downloading and installing these hot fixes, see Cisco Firepower Hot Fix Release Notes.
The Cisco Product Security Incident Response Team (PSIRT)...