Cisco Confirms Exploitation of One FMC Vulnerability and Patches a Second Rated Critical

Cisco reports active exploitation of a static credential vulnerability in Secure Firewall Management Center, the platform many organizations use to centrally administer their firewalls, while a separate authentication bypass scored 10.0 can provide unauthenticated root access to the same platform. The same hot fixes remediate both, no workaround exists for either, and CISA has set an August 1 remediation deadline for federal civilian agencies. This brief covers what Cisco has confirmed, which products require action, the indicator of compromise both advisories share, and the steps organizations operating on premises FMC should take now.

Two Advisories, One Remediation

On July 29, 2026, Cisco published a new security advisory for CVE-2026-20316, a static credential vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software. On the same day, Cisco released Version 2.0 of an advisory it first published on March 4, 2026, covering CVE-2026-20079, an authentication bypass in the same web interface. The July 29 update to the older advisory added a second Cisco bug ID, indicators of compromise, and hot fixes.

The two vulnerabilities differ in severity and in status. CVE-2026-20316 carries a CVSS base score of 5.3 and allows an unauthenticated remote attacker to log in to an affected system using static credentials for a low privilege account and access sensitive data. Cisco assigned the advisory a Security Impact Rating of High rather than Medium because, in the words of the advisory, this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges. Cisco states that in July 2026 the Cisco PSIRT became aware of active exploitation of this vulnerability. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026, with a remediation due date of August 1, 2026 for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04.

CVE-2026-20079 carries a CVSS base score of 10.0 and a Critical rating. The root cause is an improper system process created at boot time. An unauthenticated remote attacker who sends crafted HTTP requests to an affected device can execute scripts and commands with root access to the underlying operating system. Cisco credits the finding to Brandon Sakai of Cisco during internal security testing. Neither vulnerability has a workaround.

Affected Products

Product scope requires care because the two advisories do not match exactly. CVE-2026-20316 affects Cisco Secure FMC Software regardless of device configuration. Cisco confirms that Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, Secure Firewall Threat Defense Software, and Security Cloud Control are not affected.

CVE-2026-20079 affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management. Cisco notes that Security Cloud Control Firewall Management is a SaaS offering that Cisco upgrades as part of maintenance, that the fix has been deployed to those environments, and that no customer action is required for that service. Firewall Device Manager, ASA Software, FTD Software, and Security Cloud Control, formerly Defense Orchestrator, are confirmed not affected.

The practical reading is that the firewall software itself, whether ASA or FTD, is not the vulnerable component. The vulnerable component is the on premises management platform that administers those firewalls. That is where customer action is required.

Why This Matters Operationally

FMC is the central point of administration for firewall policy across an environment. An attacker with access to the management platform is positioned above the individual firewalls it controls. For port and terminal operators, vessel operators, defense manufacturers, federal contractors, and utilities, the FMC deployment frequently sits at the boundary between enterprise IT and operational networks, which makes its integrity a precondition for every segmentation and access control decision built on top of it.

Both advisories note that the attack surface associated with these vulnerabilities is reduced if the FMC management interface does not have public internet access. Network restriction limits exposure. It does not remediate the software, because no workaround exists and the vulnerable code remains present until the hot fix is applied. This publication made the same point about control systems in the July 28 brief on internet-exposed PLCs: interfaces that administer critical systems do not belong on the public internet, and removing exposure is the first control rather than the last one.

The August 1 due date in the KEV catalog binds Federal Civilian Executive Branch agencies under BOD 26-04. It does not automatically bind private organizations or defense contractors. The compressed window CISA set for federal agencies is nonetheless a clear risk prioritization signal for any organization operating an affected FMC system.

What to Do Now

1. Determine whether the organization operates an on premises Cisco Secure FMC deployment and identify the exact software release, including lab, backup, and disaster recovery instances.
2. Apply the Cisco hot fix for the installed release. Cisco lists the same six packages in both advisories, one per supported release branch, shown in the table below.
3. Confirm that the FMC management interface is not reachable from the public internet, and treat that restriction as exposure reduction rather than remediation.
4. Check for the documented indicator of compromise by running cat /var/log/messages | grep license from expert mode on the FMC. Output referencing /var/tmp/license.tmp means, in Cisco's words, that the vulnerability may have been exploited on the device. Because Cisco publishes the same indicator under both advisories, a match does not by itself establish which vulnerability was used.
5. If the indicator appears or compromise is otherwise suspected, contact the Cisco Technical Assistance Center for recovery options.
6. Rotate all user credentials, keys, and certificates on the FMC device if exploitation is suspected, which is the response Cisco explicitly recommends.
7. Review FMC administrative activity and recent firewall policy and configuration changes as a prudent investigative step, recognizing that the advisories do not state that observed exploitation resulted in changes to managed firewalls. Preserve relevant logs and system evidence before rebuilding or restoring.
8. Deploy the Snort rules Cisco lists with the CVE-2026-20079 advisory, rules 66075 through 66080, for ongoing detection.

Questions Management Should Ask Today

1. Is the administrative interface that controls our firewalls reachable from the internet, and if so, why?
2. Who is authorized to access our firewall management platform, and how is that access controlled and logged?
3. Has the July 29 hot fix been applied to every FMC deployment we operate, including lab and backup instances?
4. Has the indicator of compromise check been run, and is the result documented?
5. Could we detect unauthorized activity or unauthorized policy changes made through the management platform?
6. If rotation of the platform's credentials, keys, and certificates became necessary, how quickly could we execute it?

The Bottom Line

One FMC vulnerability is being exploited, a second can provide unauthenticated root access, no workaround exists for either, and a single hot fix per release branch remediates both. The remediation itself is straightforward. The governance question the event raises is broader: an organization that cannot say whether its firewall management platform is internet-reachable, who can access it, and whether unauthorized activity through it would be detected should assume the same gaps exist for other administrative systems of equal consequence. The patch closes these two vulnerabilities. The answers to those questions determine exposure to the next ones.