Cisco Secure FMC Static Credential Flaw Added to KEV After Zero-Day Exploitation

Cisco disclosed active zero-day exploitation of CVE-2026-20316 in Secure Firewall Management Center (FMC), a static credential flaw caused by built-in credentials for a low-privilege account. The company warned that attackers could use the issue to gain unauthorized access to vulnerable FMC appliances and potentially chain it with other, undisclosed FMC vulnerabilities to escalate privileges. Cisco released hotfixes for affected Secure FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, said no workaround is available, and advised customers to check logs for the indicator /var/tmp/license.tmp and rotate credentials, keys, and certificates if compromise is suspected.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, underscoring that the flaw is being exploited in the wild and warning that compromise of FMC could let attackers change firewall policies, disrupt monitoring, and potentially move laterally across enterprise environments. Organizations were urged to identify exposed FMC deployments, apply Cisco's fixes, restrict access to management interfaces, and review logs and configurations for evidence of unauthorized access. Cisco also updated guidance for a separate FMC authentication bypass flaw, CVE-2026-20079, but said it has no evidence that issue has been exploited.