Key Takeaways
- CISA added CVE‑2026‑20316 (CVSS 5.3) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active zero‑day exploitation.
- The flaw stems from static, low‑privilege user credentials in Cisco Secure Firewall Management Center (FMC) Software, allowing unauthenticated remote attackers to log in and view sensitive data.
- Cisco rates the vulnerability’s Security Impact Rating (SIR) as High because it can be chained with other FMC flaws to gain higher privileges.
- Hot‑fix packages are available for FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0; applying the appropriate patch mitigates the risk.
- An indicator of compromise (IoC) is the presence of “/var/tmp/license.tmp” in the output of
cat /var/log/messages | grep license. - Cisco also updated the advisory for CVE‑2026‑20079 (CVSS 10.0), a critical authentication‑bypass flaw, linking it to the same IoC and noting potential chaining for code execution, although no active exploitation of this second flaw has been observed.
- Federal Civilian Executive Branch (FCEB) agencies must apply the fixes by August 1, 2026 per CISA guidance.
Overview of the Newly Added Vulnerability (CVE‑2026‑20316)
On July 30, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) inserted CVE‑2026‑20316 into its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability affects Cisco Secure Firewall Management Center (FMC) Software and carries a CVSS base score of 5.3. Cisco’s advisory explains that the issue arises from static, hard‑coded credentials for a low‑privilege account embedded in the software. An attacker who knows—or can guess—these credentials can log in remotely without authentication and subsequently access any data that the low‑privilege user is permitted to see. While the direct impact is limited to data exposure, the flaw’s exploitability in the wild prompted CISA’s urgent inclusion in the KEV list.
Attack Surface and Mitigating Factors
Cisco emphasized that the attack surface for CVE‑2026‑20316 is considerably reduced when the FMC management interface is not exposed to the public internet. Organizations that restrict access to the FMC GUI or SSH services to trusted networks lower the likelihood of remote credential guessing. Nevertheless, the presence of static credentials means any network segment that can reach the management interface—whether through a misconfigured firewall, VPN, or internal threat—remains at risk. Cisco advises administrators to review network segmentation rules and ensure that only authorized administrators can reach the FMC management plane.
Security Impact Rating and Privilege Escalation Potential
Although the base CVSS score suggests a medium severity, Cisco assigned a Security Impact Rating (SIR) of High to CVE‑2026‑20316. The justification lies in the vulnerability’s potential to be chained with other flaws in the same FMC product line. By first logging in via the low‑privilege account, an attacker could leverage additional weaknesses—such as insufficient input validation or improper privilege checks—to escalate to root or admin rights. This chaining capability elevates the overall risk, prompting Cisco to treat the flaw as a high‑impact issue despite its modest standalone score.
Discovery and Active Exploitation Details
The flaw was discovered and reported by security researcher Jimi Sebree of Horizon3.ai. Cisco acknowledged that the vulnerability has been under active exploitation since earlier in July 2026, although the advisory does not disclose the exact start date, the threat actors involved, or the precise exploitation techniques observed in the wild. The lack of public technical details is typical for early‑stage zero‑day disclosures, but the confirmation of active use compelled Cisco to release hot‑fixes and for CISA to place the vulnerability in the KEV catalog, mandating timely remediation for federal agencies and strongly encouraging private‑sector patching.
Available Hot‑Fix Packages
To address CVE‑2026‑20316, Cisco released version‑specific hot‑fix scripts for the affected FMC releases:
- 7.0 –
Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar - 7.2 –
Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar - 7.4 –
Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar - 7.6 –
Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar - 7.7 –
Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar - 10.0 –
Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar
Administrators should download the appropriate package from Cisco’s Software Center, verify its integrity via the provided checksums, and apply it following the standard hot‑fix installation procedure (typically uploading the tar file via the FMC CLI or GUI and executing the script). Rebooting the device is not usually required, but a post‑install verification of the fixed version is recommended.
Indicator of Compromise (IoC) and Detection Guidance
Cisco provided a concrete IoC to help organizations detect possible exploitation: executing the command
cat /var/log/messages | grep license
in expert mode on the FMC. If the output contains a reference to /var/tmp/license.tmp, it suggests that the vulnerability may have been abused. An example log line shown in the advisory is:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp –lsm
Presence of this pattern indicates that a process running as the low‑privilege www user attempted to execute a package‑info script on a temporary license file—a behavior associated with the exploit chain. Organizations should schedule this check as part of routine log‑monitoring or integrate it into SIEM rules to trigger alerts when the string appears.
Related Advisory Update for CVE‑2026‑20079
In tandem with the KEV addition, Cisco updated the advisory for CVE‑2026‑20079, a critical authentication‑bypass flaw (CVSS 10.0) that allows execution of arbitrary script files to obtain root access. The revised notice adds a second bug identifier (CSCwt95974), reiterates the same /var/tmp/license.tmp IoC, and lists the identical hot‑fix packages as mitigations. While Cisco states it has no evidence of active exploitation for CVE‑2026‑20079, the shared IoC implies that threat actors could potentially chain the two vulnerabilities: first use the low‑privilege credential flaw (CVE‑2026‑20316) to gain a foothold, then leverage the authentication‑bypass bug to escalate to root and run malicious scripts. This underscores the importance of applying the hot‑fixes promptly, as they remediate both issues simultaneously.
Compliance Deadline for Federal Agencies
Given the confirmed active exploitation, CISA has issued a binding directive for Federal Civilian Executive Branch (FCEB) agencies: apply the relevant hot‑fixes for both CVE‑2026‑20316 and CVE‑2026‑20079 no later than August 1, 2026. Failure to meet this deadline could result in non‑compliance with federal cybersecurity requirements and increase the risk of data breach or service disruption. Private‑sector organizations, while not under a mandatory deadline, are strongly encouraged to prioritize patching within the same timeframe to protect against the observed zero‑day activity and prevent potential privilege‑escalation chains.
By following the outlined detection steps, applying the appropriate hot‑fixes, and restricting management‑interface exposure, administrators can effectively mitigate the risk posed by CVE‑2026‑20316 and its potential combination with CVE‑2026‑20079.