Cisco patches actively exploited FMC zero-day — federal agencies face August 1 deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) to its Known Exploited Vulnerabilities (KEV) catalog on July 29, setting a remediation deadline of August 1 for all federal civilian agencies. The flaw, CVE-2026-20316, has been actively exploited in the wild since earlier this month.

The root cause is a classic but high-impact mistake: Cisco Secure FMC ships with hardcoded static credentials for a low-privilege user account. Any unauthenticated remote attacker who learns those credentials can log directly into an exposed FMC instance and access sensitive configuration data without bypassing any additional security layer. According to Cisco, the attack surface is reduced if the FMC management interface is not reachable from the public internet — but enterprises that have exposed the management plane are at immediate risk.

Why Cisco rated this "High" despite a CVSS score of 5.3

A CVSS score of 5.3 would normally sit in the medium-severity range. Cisco overrode that rating with a Security Impact Rating (SIR) of High because of chaining risk. Attackers who gain a foothold through the static-credential bug can combine it with other Cisco Secure FMC vulnerabilities to escalate to full administrative control. Cisco Secure FMC is the centralized management console for the Firepower family of firewalls — products widely deployed in large enterprises and government networks. An attacker with admin access to FMC can read, modify, or exfiltrate entire firewall policy configurations.

Security researcher Jimi Sebree of Horizon3.ai discovered and reported the flaw. Cisco confirmed active exploitation began in July 2026, but has not disclosed who is behind the attacks, how the static credentials became known to threat actors, or how many organizations were affected.

Affected versions and fixes

The vulnerability affects Cisco Secure FMC versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Cisco has released hotfixes for all affected versions. There is no workaround available — the only remediation is applying the patch. Cisco also recommends restricting the FMC management interface from public internet access as a secondary control.

How to check for compromise

Cisco published a specific indicator of compromise: in expert mode on the FMC command line, run cat /var/log/messages | grep license. If the output includes a reference to /var/tmp/license.tmp, the device may have been compromised. Organizations that find this IoC should immediately rotate all user credentials, keys, and certificates on the affected FMC instance and contact Cisco TAC.

The 72-hour federal window — from CISA's KEV addition on July 29 to the August 1 deadline — is unusually compressed and reflects CISA's assessment that exploitation is active and ongoing. Enterprise security teams running Cisco Firepower environments should treat CVE-2026-20316 as an emergency patch, not a scheduled maintenance item. As reported by The Hacker News, this vulnerability was first disclosed in Cisco's official security advisory alongside the hotfix releases.