cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Cisco Fixes Actively Exploited Secure FMC Static Credential Flaw

· Original article ↗

Summary

Cisco says CVE-2026-20316 was actively exploited to access vulnerable Secure FMC devices and released hot fixes. It also patched CVE-2026-20079, an authentication bypass it says has not been exploited.

Key points

  • Cisco says attackers actively exploited CVE-2026-20316, which involves static credentials for a low-privilege account and can provide remote access to sensitive data.
  • Cisco has not identified the additional vulnerabilities reportedly used to elevate privileges or disclosed the targeted organizations or attackers.
  • The flaw affects Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0; Cisco released hot fixes and says there is no workaround.
  • Cisco says CVE-2026-20079 allows unauthenticated remote attackers to run scripts and commands as root, but it is not aware of malicious exploitation.
  • For possible compromise, Cisco advises checking /var/log/messages for an entry involving /var/tmp/license.tmp; affected organizations should rotate credentials, keys, and certificates and contact Cisco TAC.
  • Cisco has not explained whether the two vulnerabilities are connected, despite publishing the same indicator for both.

Article Details

Vulnerability Types
  • Static credentials
  • Authentication bypass
Severity
High for CVE-2026-20316; Critical for CVE-2026-20079
Affected Versions
  • Cisco Secure FMC Software 7.0
  • Cisco Secure FMC Software 7.2
  • Cisco Secure FMC Software 7.4
  • Cisco Secure FMC Software 7.6
  • Cisco Secure FMC Software 7.7
  • Cisco Secure FMC Software 10.0
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1078.001 · Default AccountsCVE-2026-20316 was exploited using static credentials for a low-privilege account built into Cisco Secure FMC Software.T1190 · Exploit Public-Facing ApplicationCVE-2026-20079 allows a remote attacker to bypass authentication by sending specially crafted HTTP requests to an affected FMC device.

CVE

CVE-2026-20079Cisco also patched CVE-2026-20079, a critical FMC authentication bypass issue that can let unauthenticated attackers run commands as root, and released hot fixes for affected Secure FMC versions.CVE-2026-20316Cisco is warning that CVE-2026-20316, a high-severity Secure Firewall Management Center static credential flaw, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.

People

Jimi SebreeReported the CVE-2026-20316 vulnerability, according to the article.

Vendors

CiscoCisco is warning that CVE-2026-20316, a high-severity Secure Firewall Management Center static credential flaw, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.

Products

Cisco Secure Firewall Management CenterCisco is warning that CVE-2026-20316, a high-severity Secure Firewall Management Center static credential flaw, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.Cisco Secure FMC SoftwareCVE-2026-20316 uses static credentials built into Cisco Secure FMC Software.

Related Articles