CVE-2026-20316: Cisco FMC — Zero-Day Enables Data Exposure (July 2026)

CVE-2026-20316 — Cisco Secure Firewall Management Center

CVE-2026-20316 is a high-severity zero-day vulnerability in Cisco Secure Firewall Management Center (FMC), actively exploited as of July 2026. The flaw allows unauthenticated attackers to access sensitive data using static low-privileged credentials. Cisco has confirmed exploitation in the wild and issued urgent hotfixes. A related critical vulnerability, CVE-2026-20079, may be chained for privilege escalation.

Attack Vector

Attackers exploit static credentials to gain unauthorized access to Cisco FMC devices. No authentication is required, and exploitation can occur remotely if the management interface is exposed. Indicators of compromise include the presence of /var/tmp/license.tmp and log entries matching cat /var/log/messages | grep license. Chaining with CVE-2026-20079 can escalate privileges, potentially allowing full administrative control.

Who Is at Risk

All organizations running Cisco Secure Firewall Management Center are exposed, with confirmed targeting of Cisco Systems and US Federal Civilian Executive Branch agencies. Both on-premises and cloud-managed FMC deployments are vulnerable if unpatched. Critical infrastructure and government networks are at heightened risk due to active exploitation.

Patch & Mitigate

• Patch: Apply Cisco-issued hotfixes for FMC immediately; US federal agencies must patch by August 1, 2026.
• Workaround: Restrict management interface access to trusted networks only. Disable unused accounts and monitor for unauthorized access.
• Detect: Search for /var/tmp/license.tmp and review logs for suspicious license-related activity using cat /var/log/messages | grep license.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers leverage exposed FMC interfaces to gain entry.
• TA0006 — Credential Access: Static credentials are abused for unauthorized access.
• TA0008 — Lateral Movement: Chaining with other vulnerabilities enables privilege escalation and broader compromise.

Source: https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html