Cisco FMC Under Attack: Urgent Hotfixes for Two Vulnerabilities, One Actively Exploited Zero-Day

Introduction

On July 29, 2026, Cisco released hotfixes for two critical vulnerabilities in Secure Firewall Management Center (FMC) software. One of them, identified as CVE-2026-20316, was exploited in zero-day attacks to gain unauthorized access to devices. The second (CVE-2026-20079) has a maximum CVSS score of 10.0 and allows remote command execution as root, but no evidence of malicious exploitation has been observed so far. Both advisories share a single indicator of compromise, while Cisco has not clarified any direct link between the flaws. There are no alternative mitigations: immediate application of the hotfixes is the only effective countermeasure.

Technical Analysis

The vulnerabilities affect on-premises versions of Cisco Secure FMC Software (7.0, 7.2, 7.4, 7.6, 7.7, and 10.0). Cloud-delivered products, Firewall Device Manager, Secure Firewall ASA, Threat Defense, and Security Cloud Control are not impacted.

CVE-2026-20316 (CVSS 5.3, rated High by Cisco) is due to static credentials for a low-privilege account embedded in the FMC software. A remote unauthenticated attacker can leverage them to access sensitive data and, when combined with other vulnerabilities, escalate privileges. The flaw was discovered by Jimi Sebree (Horizon3.ai) and has been used in real-world attacks since July 2026.

CVE-2026-20079 (CVSS 10.0, Critical) involves a system process that starts improperly during software boot. By sending specially crafted HTTP requests, a remote unauthenticated attacker can execute commands and scripts with root privileges, fully compromising the system's confidentiality, integrity, and availability. The advisory was initially published in March 2026 and updated on July 29 with hotfixes and the common indicator of compromise.

Indicator of Compromise (IoC)
Both advisories highlight the presence of the string /var/tmp/license.tmp in the /var/log/messages file. To check for compromise, in expert mode run:

cat /var/log/messages | grep license

An example of a suspicious log entry is:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

If this string is detected, the device may have already been compromised.

Impact

The vulnerability CVE-2026-20316, despite its relatively low CVSS score (5.3), has been rated High because it can serve as an initial vector for broader attacks. The use of static credentials makes it trivial to find and exploit, and the fact that it has already been employed in real campaigns increases its severity. Cisco has not provided details on the threat actors or targets.

CVE-2026-20079 poses maximum risk: the 10.0 score indicates a total impact on all three security pillars (confidentiality, integrity, availability). Although no malicious activity has been observed yet, the common IoC with the zero-day flaw suggests that an attacker with initial access could attempt to weaponize it for deeper control.

Mitigation

Cisco has released hotfixes for all affected versions (7.0, 7.2, 7.4, 7.6, 7.7, 10.0). There are no workarounds: applying the updates is the only way to resolve both vulnerabilities.

In addition to immediate hotfix deployment, it is recommended to:

• Do not expose the FMC management interface on public or untrusted networks.
• Check logs on all FMC devices using the command provided above.
• If an IoC is detected, immediately rotate all associated credentials, keys, and certificates, and contact Cisco TAC to initiate incident response procedures.
• Continuously monitor systems even after updating, as attackers may have already established backdoors or persistence.

FAQ

1. Which Cisco FMC versions are affected?
On-premises versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 are affected. Cloud-delivered variants, Firewall Device Manager, Secure Firewall ASA, Threat Defense, and Security Cloud Control are not vulnerable.

2. How can I verify if my system has been compromised?
In expert mode, run the command cat /var/log/messages | grep license. The presence of the string /var/tmp/license.tmp indicates a possible compromise, requiring immediate activation of incident response procedures.

3. Is it necessary to apply hotfixes for both vulnerabilities?
Yes. Although only CVE-2026-20316 has been exploited in the wild so far, CVE-2026-20079 has a CVSS score of 10.0 and represents a risk equivalent to total compromise. With no workarounds available, the update resolves both flaws in a single step.