Cisco has confirmed that attackers are actively exploiting hardcoded credentials in its Secure Firewall Management Center (FMC) — the console that organisations use to manage entire fleets of Cisco firewalls. The vulnerability, tracked as CVE-2026-20316, allows an unauthenticated remote attacker to log in as a low-privileged user and then chain other FMC flaws to escalate access. No workaround exists. Hot fixes only.
🔍 THE BOTTOM LINE
Hardcoded credentials in critical infrastructure software is the kind of basic security failure that should not ship from a vendor like Cisco. The FMC is not a peripheral tool — it is the management plane for an organisation’s entire firewall fleet. Compromise the FMC, and you potentially compromise every firewall it controls. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day Cisco disclosed it, giving US federal agencies until August 1 to patch. That is a 48-hour window. NZ organisations running Cisco firewalls should treat this with the same urgency.
What Happened
According to The Hacker News, the vulnerability stems from static user credentials baked into the FMC software’s web interface. An attacker who knows the credential — which is now publicly documented in Cisco’s advisory — can log in remotely without authentication.
Cisco’s own advisory states: “This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system.”
The attacker lands as a low-privileged user, but Cisco rated the flaw High rather than Medium because it can be chained with other FMC vulnerabilities — including CVE-2026-20079 (CVSS 10.0), a critical authentication bypass that enables root access. The same indicator of compromise appears in both flaws, suggesting attackers may already be chaining them.
Security researcher Jimi Sebree of Horizon3.ai discovered and reported the vulnerability. Cisco acknowledged that exploitation began earlier this month but has not disclosed who is behind the attacks or how many organisations have been compromised.
Why This Matters — Check Your Estate Today
This is not a “watch and wait” story. This is a “check your estate today” story.
Why FMC compromise is worse than a single firewall breach: FMC is the central management console for Cisco Secure Firewall deployments. It pushes policies, configurations, and rules to every firewall under its control. If an attacker gains access to FMC, they potentially control the security posture of every firewall it manages. This is not one door being left open — it is someone getting the master key to the building.
What to do today:
- Identify — Find every Cisco Secure FMC instance in your environment. Check versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.
- Check for compromise — Run
cat /var/log/messages | grep licensein expert mode on each FMC. If the output includes/var/tmp/license.tmp, the system may have been exploited. - Patch — Apply the Cisco hot fix for your version. There is no workaround. Hot fixes only.
- Restrict access — Cisco notes the attack surface is reduced if the FMC management interface is not exposed to the public internet. If yours is, restrict it immediately.
- Review — If compromise is suspected, review all firewall policy changes made through FMC since July 1, 2026.
The Hardcoded Credentials Problem
This is not the first time hardcoded credentials have shipped in enterprise software, and it raises a question that should make every IT professional uncomfortable: how does a vendor of Cisco’s stature ship static credentials in a security product?
Hardcoded credentials are a well-known anti-pattern — OWASP lists them as a top vulnerability class. They are the kind of thing that automated code scanning tools, including AI-based security scanners, are designed to catch. The fact that this made it through Cisco’s QA process into production software used by governments and enterprises worldwide suggests either a gap in their security review pipeline or a culture where speed-to-ship overrides basic security hygiene.
This connects to a broader pattern we have been tracking: AI coding tools can catch these flaws, but only if organisations actually use them in their CI/CD pipelines. The SymJack symlink hijack vulnerability we covered earlier showed how AI coding agents can introduce security flaws. But the flip side is that AI scanning tools are also uniquely good at finding hardcoded credentials — they are exactly the kind of pattern that static analysis with language models catches reliably.
The NZ Angle — No Domestic Alert, Same Exposure
Here is the uncomfortable reality for NZ IT leaders: the GCSB’s National Cyber Security Centre maintains the NZ Information Security Manual (NZISM) as the framework for government system security — but NZ has no equivalent of CISA’s Known Exploited Vulnerabilities catalog. There is no domestic alert that will tell you a critical flaw is being actively exploited and give you a deadline to patch. NZ organisations that wait for a local warning will always be behind the US patching window.
For this vulnerability, that gap matters. Cisco firewalls are widely deployed across NZ enterprise and government networks. Spark NZ is Cisco’s primary distribution partner, providing Cisco Secure Firewall and Meraki SASE services to mid-market, enterprise, and government customers. SEEK currently lists 117 Cisco firewall-related jobs in NZ — a rough proxy for the installed base, but a meaningful one. That is a lot of FMC consoles that need checking.
The practical takeaway for NZ IT leaders: treat CISA’s KEV catalog as your alert system, because NZ does not have one. The US government’s 48-hour patching mandate for federal agencies is a reasonable benchmark for any NZ organisation running affected Cisco gear — not a ceiling, but a floor.
What Makes This Worse
Cisco has also updated its advisory for CVE-2026-20079, a critical authentication bypass (CVSS 10.0) affecting the same FMC software, to include the same indicators of compromise. While Cisco says it is not aware of active exploitation of that flaw, the shared IoC suggests attackers may be chaining both vulnerabilities — using the hardcoded credentials to get in, then the authentication bypass to escalate to root.
The combination is significant: initial access via hardcoded credentials (no authentication needed) → lateral access via authentication bypass → root access to the firewall management plane. That is a full compromise chain, and it is available to anyone who can reach the FMC web interface.
❓ FAQ
What is Cisco Secure FMC? Cisco Secure Firewall Management Center (FMC) is the central management console for Cisco’s Secure Firewall product line. It allows administrators to configure policies, deploy rules, and monitor multiple firewalls from a single interface. Formerly known as Firepower Management Center.
What versions are affected? Versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 of Cisco Secure FMC Software. Hot fixes are available for each version.
Is there a workaround? No. Cisco says hot fixes are the only remediation. Restricting FMC management interface access to internal networks reduces the attack surface but does not eliminate the vulnerability.
How do I check if my FMC has been exploited?
Run cat /var/log/messages | grep license in expert mode. If the output contains references to /var/tmp/license.tmp, the system may have been exploited. Cisco provides this as an indicator of compromise.
Does this affect NZ organisations? Yes. Cisco firewalls are widely used in NZ enterprise and government. Spark NZ is Cisco’s primary partner in the NZ market. Any organisation running Cisco Secure FMC on the affected versions should patch immediately.
What is CISA’s KEV catalog? The Known Exploited Vulnerabilities catalog is maintained by the US Cybersecurity and Infrastructure Security Agency. It lists vulnerabilities that have been confirmed as actively exploited. US federal agencies are required to patch KEV-listed vulnerabilities within specified timeframes — August 1, 2026, in this case.
🔍 THE BOTTOM LINE
A hardcoded credential in a security product is a failure of process, not technology. The fix is straightforward — apply the hot fix. But the deeper question is why this shipped in the first place, and whether your organisation’s vulnerability management process is built to respond within hours, not weeks. CISA gave US agencies 48 hours. NZ organisations should be working to the same clock.
📰 Sources
- The Hacker News — Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
- BleepingComputer — Cisco warns of FMC static credential flaw exploited in zero-day attacks
- CISA — Known Exploited Vulnerabilities Catalog
- Cisco Security Advisory — Cisco Secure Firewall Management Center Software Static Credential Vulnerability
- Gridinsoft — Cisco FMC CVE-2026-20316 Exploited: Patch Now
— CJ Murden, editor of Singularity.Kiwi. Former digital technologies teacher, author of AI-focused books. Writing with a New Zealand focus.
