Attackers Found Cisco's Hardcoded FMC Password Before You Did

Cisco just confirmed that attackers have been logging into Secure Firewall Management Center appliances with a password Cisco itself shipped in the product. CVE-2026-20316 is a hardcoded credential for a low-privileged account in FMC's web interface — no authentication bypass, no memory corruption, no exploit development required. You send a login request with the baked-in credentials and you're in, able to read whatever that account can see. Cisco's PSIRT says exploitation started sometime in July; the advisory landed July 29, and CISA added the bug to its Known Exploited Vulnerabilities catalog the same day with a remediation deadline of August 1. Three days, not the usual three weeks. That compressed window tells you how CISA is reading this, whatever the CVSS score says.

And the CVSS score says 5.3.

Attackers exploit paths, not scores

Here's the wrinkle that makes this more than another patch-Tuesday item. Back in March, Cisco disclosed CVE-2026-20079 — an authentication bypass in the same product's web interface, rated a perfect CVSS 10.0, giving unauthenticated attackers root on the underlying OS. Four months later, Cisco still says it has no evidence anyone has exploited it. Meanwhile the humble 5.3 static credential is the one being used in the wild.

That's not as irrational as it looks. The 10.0 bug depends on a boot-time race — a leftover session that only persists if no user authenticates after the system starts. The 5.3 bug is a password that works every time, on every unpatched box, and produces log entries that look like a normal login. If you're an intruder choosing between a temperamental exploit and a guaranteed credential, you take the credential. Reliability and stealth beat raw impact ratings.

Cisco knows this, which is why it slapped a High severity rating on a 5.3-scored bug: the advisory explicitly warns the foothold "can be combined with other vulnerabilities in FMC software to elevate privileges." Read that next to the fact that Cisco's updated CVE-2026-20079 advisory now lists the identical indicators of compromise and the identical hotfixes, and the picture sharpens: Cisco is treating these as one attack surface. Log in with the static account, escalate to root, own the box.

The practical lesson for anyone running vulnerability management: if your pipeline triages by CVSS base score, this bug sat comfortably below your critical-SLA threshold while attackers were actively using it. KEV membership and vendor severity ratings need to outrank base scores in your prioritization logic, or you'll keep patching theoretical 10.0s while real 5.3s eat you.

Why FMC is worth burning a zero-day on

FMC isn't a firewall — it's the thing that manages your firewalls. A typical deployment has one FMC (or an HA pair) holding the policy, objects, VPN configuration, and deployment pipeline for every Firepower Threat Defense device in the estate. Even the low-privileged foothold hands an attacker reconnaissance gold: network topology, access-control policy, what's allowed to talk to what. Chained to root, it's a position to push configuration to the entire firewall fleet.

This is the third consecutive year attackers have gone after Cisco's perimeter stack with zero-days. ArcaneDoor hit ASA and FTD devices in 2024; last September's ASA campaign was serious enough that CISA issued an emergency directive giving federal agencies roughly a day to respond. Cisco hasn't attributed the FMC attacks or named targets, and nobody has published the exploitation chain, so resist the urge to assume it's the same actors — but the pattern of sophisticated, patient targeting of network-edge management infrastructure is now well established. The management plane is where the leverage is.

A password in the build is a pipeline failure

The affected versions are the part that should sting: 7.0, 7.2, 7.4, 7.6, 7.7 — and 10.0, the current release line. This credential isn't legacy cruft that survived in an old branch; it shipped in the newest code. The indicator of compromise (log references to /var/tmp/license.tmp) suggests the account is plumbing for licensing internals, which fits the usual pattern: a service or test account that engineering needed, that nobody inventoried, that release tooling never flagged. Cisco has been here before — CVE-2023-20101 was static root credentials in Emergency Responder, and 2018 saw a whole run of hardcoded-credential advisories across its portfolio. CWE-259 is a solved problem at build time; secret-scanning your own firmware images is table stakes for a security vendor in 2026. That it keeps recurring is a statement about process, not one engineer's mistake.

Worth noting: cloud-delivered FMC isn't affected. Cisco patches and rotates that control plane itself. There's a real argument forming that self-hosted management appliances are becoming the riskiest tier of infrastructure — though a SaaS control plane just trades your patching lag for a much bigger shared blast radius.

What to actually do

There are no workarounds. Cisco shipped per-branch hotfixes (for example, Hotfix_P-10.0.1.1-2 on 10.0); install the one for your release train now, not at the next maintenance window. Before or after, check for compromise from expert mode:

cat /var/log/messages | grep license

Any hit referencing /var/tmp/license.tmp means the vulnerability was triggered on your box. In that case, patching is the start of your incident: rotate every credential, key, and certificate the FMC holds — it manages your firewalls, so assume everything it touches is exposed — and get Cisco TAC involved.

Then fix the exposure that made this exploitable at scale: FMC's management interface has no business being reachable from the internet. Horizon3.ai's Jimi Sebree found this bug; opportunistic scanners will have working requests soon, and against internet-facing FMCs this is about as low-effort as exploitation gets. The patch closes this hole. Only network placement closes the class.