The Firewall Manager Shipped With a Password Attackers Already Knew.
Cisco has confirmed active exploitation of static credentials in Secure Firewall Management Center. The embedded account is low privilege, but the management platform’s position and the possibility of exploit chaining turn a limited login into a high-priority incident question.
A fixed credential opened the web interface
CVE-2026-20316 is a static-credential vulnerability in Cisco Secure Firewall Management Center, or FMC. An unauthenticated remote attacker who knows the embedded credentials can log in to the web interface as a low-privileged user and access sensitive data.
The flaw affects FMC regardless of configuration. Cisco says cloud-delivered FMC, Firewall Device Manager and Adaptive Security Appliance Software are not affected.
Cisco assigns a CVSS score of 5.3 but rates the security impact High. The reason is important: the company warns that the access could be combined with other FMC vulnerabilities to gain higher privileges. Cisco’s Product Security Incident Response Team says it became aware of active exploitation in July.
The advisory does not say that the static account alone provides administrator or root access. Reporting it that way would overstate the finding. It does provide a known foothold on a sensitive management system, and attackers have been using it.
The management plane concentrates trust
FMC is used to manage firewall policies, devices, events and security operations. Even a low-privileged account can reveal information that makes a later attack easier, including details about the environment, its controls and its connected systems.
The chaining warning also challenges vulnerability processes that rank each issue in isolation. A medium numerical score can hide the operational value of a reliable first step. Once an attacker has authenticated, other code paths may become reachable and other weaknesses may become easier to exploit.
That is why the location of the flaw matters as much as the score. A static credential in an ordinary application is serious. A static credential in the system that administers security policy deserves immediate attention.
Cisco has hot fixes and fixed releases, but no workaround
Cisco says there are no workarounds. It provides hot fixes and fixed software releases, with the exact remediation path depending on the FMC version in use.
The vendor also documents an indicator in system logs involving /var/tmp/license.tmp. Its presence should prompt investigation, but its absence should not be treated as proof that a system is clean. Indicators are observations, not complete detection coverage.
Cisco recommends rotating all user credentials, keys and certificates if exploitation is suspected. That advice reflects the role of the management centre and the possibility that attackers used their foothold to collect more durable access.
Treat a vulnerable FMC as an identity and control-plane incident
Defenders should:
- Inventory every on-premises FMC instance, including standby, test and migration systems.
- Apply Cisco’s hot fix or move to the appropriate fixed release.
- Restrict the web interface to dedicated management networks and authorised administrator hosts.
- Review logs for the vendor’s indicator and for unexpected logins, configuration changes and new accounts.
- Compare current firewall policy and device configuration with a known-good baseline.
- Rotate user passwords, API credentials, keys and certificates if compromise is suspected.
- Investigate connected firewalls and administrative endpoints for activity originating from the FMC.
Where integrity cannot be established, recovery may require rebuilding the manager from trusted software and carefully restoring validated configuration. Simply changing the visible password does not address any secondary access an attacker may have created.
Static credentials remove one of the attacker’s hardest steps
An internet attacker normally has to steal, guess or phish a valid identity. A static credential built into a product replaces that uncertain step with a known value.
Network restrictions still matter. A management interface that cannot be reached by untrusted systems is harder to exploit. But segmentation should reduce exposure, not excuse a credential that every affected installation shares.
The immediate task is to apply Cisco’s fix and investigate. The larger lesson is to treat security-management platforms as high-value identity systems. Their accounts, interfaces and recovery procedures need controls at least as strong as those applied to the devices they manage.
Update, 1 September 2026: FMC also had a ransomware-linked root RCE
The static credential in CVE-2026-20316 was not Cisco FMC’s only exploited entry path in 2026. CVE-2026-20131 is a separate CVSS 10 deserialization vulnerability in the web management interface. A remote attacker needs no credentials and can execute arbitrary Java code as root.
Cisco published the advisory on 4 March and later confirmed active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 19 March, with known ransomware use recorded. The distinction matters: CVE-2026-20316 provides a low-privileged foothold through a fixed account, while CVE-2026-20131 crosses directly from the network to root.
Cisco says there is no workaround. Administrators must install a fixed release listed in the advisory, restrict management access to trusted networks and investigate exposed FMC systems for unexpected Java execution, new accounts, policy changes and outbound connections.
Primary sources: Cisco security advisory, CISA KEV catalogue and the Cloud Security Alliance research note.
Update, 10 September: a second authentication failure is being exploited
Cisco has now confirmed active exploitation of a separate CVSS 10 vulnerability in the same management platform. CVE-2026-20079 lets an unauthenticated remote attacker bypass authentication and execute scripts or commands with root privileges on vulnerable on-premises Secure Firewall Management Center and SCC Firewall Management deployments.
Cisco first published the advisory on 4 March and updated it on 9 September after PSIRT became aware of exploitation activity dating from August. Cisco-hosted software-as-a-service environments were patched by Cisco, but customers remain responsible for on-premises systems. There is no workaround.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 9 September and set a 12 September remediation deadline. Cisco says defenders should review logs for entries containing package_info.*license together with /var/tmp/license.tmp. The hotfix prevents future exploitation but does not remediate an already compromised appliance, so exposed systems require investigation as well as patching.
- Apply Cisco’s fixed release or hotfix immediately and verify the running version.
- Search for Cisco’s published log indicator and preserve appliance evidence before destructive remediation.
- Review command execution, new files, accounts, configuration changes and connections originating from the management centre.
- Rotate credentials and tokens accessible from the appliance if compromise cannot be excluded.
The original static-credential flaw and this authentication bypass are distinct vulnerabilities. Coverage of one does not close the other. Both demonstrate why a firewall manager must be treated as a privileged control plane rather than an ordinary management interface.
Update, 11 September: Talos found three campaigns behind the exploitation
Cisco Talos has now described three distinct intrusion clusters involving the two FMC vulnerabilities. They should not be collapsed into one campaign. The actors, initial-access evidence and post-compromise activity differ, even though all three reached the same sensitive firewall-management platform.
In the first cluster, UAT-12197 exploited CVE-2026-20079, installed a JSP web shell and a Java command executor, and exfiltrated credentials. This is the clearest example of the CVSS 10 authentication bypass becoming root-level control without a prior login.
In the second, Talos assesses with high confidence that UAT-11823 exploited both CVE-2026-20079 and CVE-2026-20316. The actor deployed a Netcat reverse shell, stole managed-device configurations and installed a variant of Cyclops Blink. Talos says the cluster overlaps in tooling with the Russian Sandworm group. That is an attribution assessment about the observed cluster, not proof that every exploitation attempt belongs to Sandworm.
The third cluster, UAT-11988, began with the static credentials tracked as CVE-2026-20316. Talos assesses with high confidence that this actor is a ransomware operator. It used built-in FMC tools for reconnaissance, deployed tunnels, harvested credentials and assembled a list of endpoints to encrypt or lock. The subsequent behaviour was consistent with Qilin ransomware affiliates, but Talos does not present the static credential as proof that every affected FMC led to ransomware.
The three clusters turn the original chaining warning into observed incident-response work. Defenders need to hunt for web shells and Java execution, reverse shells and Cyclops Blink, and the living-off-the-land activity associated with ransomware preparation. Finding evidence from one cluster does not exclude the others.
- Use Talos’s cluster-specific indicators instead of relying only on Cisco’s
/var/tmp/license.tmplog clue. - Compare managed firewall configurations with trusted baselines and investigate unexplained exports from FMC.
- Search for JSP web shells, unfamiliar JAR files, Netcat listeners, proxy or tunnelling tools and Cyclops Blink indicators.
- Review endpoint targeting, credential access and bulk remote activity that could indicate ransomware preparation.
- Contact Cisco TAC when compromise is suspected. Cisco states that the hotfixes prevent future exploitation but may not remove an existing intrusion.
Cisco says a broader hardening release containing the two hotfixes and other internally discovered fixes is planned for the week of 14 September. That future release does not extend the current response window. The CISA deadline for CVE-2026-20079 is 12 September, and an exposed unpatched manager should already be treated as an investigation target.
Sources and further reading
- Cisco security advisory
- BlackTree CVE record
- Cisco Security Advisory, first published 4 March 2026 at 16:00 GMT and updated 9 September 2026 at 16:00 GMT.
- Cisco Talos, published 9 September 2026 at 12:08 as displayed by Cisco.
- CISA KEV, entry added 9 September 2026, no publication time provided.
