Cisco FMC Zero-Day Actively Exploited via Static Credentials

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed flaw in Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog after confirming active zero-day exploitation. Tracked as CVE-2026-20316 with a CVSS score of 5.3, the vulnerability stems from the presence of static user credentials for a low-privileged account, allowing an unauthenticated, remote attacker to log in and access sensitive data on susceptible systems. Cisco flagged the bug with a High Security Impact Rating (SIR) because it can be chained with other FMC flaws to escalate privileges. Security researcher Jimi Sebree of Horizon3.ai is credited with discovering and reporting the issue.

Cisco acknowledged that exploitation began earlier this month but did not disclose the threat actors involved or the attack methodology. The company noted that the attack surface is significantly reduced when the FMC management interface is not exposed to the public internet, a configuration worth verifying with a port scanner to confirm no unnecessary services are reachable externally. To detect potential compromise, administrators can run the CLI command "cat /var/log/messages | grep license" in expert mode; output containing "/var/tmp/license.tmp" suggests the device may have been exploited. Patches are available across versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 via dedicated hotfix bundles.

In parallel, Cisco updated its advisory for CVE-2026-20079—a critical authentication bypass flaw with a maximum CVSS score of 10.0—to include a second bug ID (CSCwt95974), the same indicators of compromise, and matching hotfixes. While no malicious exploitation of CVE-2026-20079 has been observed, its severity makes it a priority for remediation. Organizations running affected FMC deployments should apply patches immediately, audit management interface exposure, and rotate any potentially compromised credentials. Given that the root cause is hardcoded default credentials, security teams should also use a password checker to audit all service accounts across their infrastructure and ensure no similar static secrets remain in production environments.