Cisco FMC Software has a weak password
Cisco's Secure Firewall Management Center has a hidden built-in account with a fixed, unchangeable password. Anyone on the network who reaches the login page can use it to sign in and view sensitive data on the system, and Cisco says attackers have already been doing this.
- Severity
- MediumCVSS 3.1 · 5.3
- Fix
- Fixed in 7.0.9.1, 7.2.11.1, 7.4.7.1 +3Fix recorded on Aug 26, 2026
- Weakness
- CWE-259
- Exploit likelihood
- 11% in 30 daysEPSS, higher than 96% of known flaws
- Affects
- Cisco Secure Firewall Management Center+1 more
- Exploited
- Yes, in the wildListed by CISA, used in ransomware
- Added to CISA list
- Jul 29, 2026
- Federal fix deadline
- Aug 1, 2026
How it works
FMC ships with a low-privilege account whose username and password are hardcoded into the software rather than set uniquely per install, so anyone who knows that fixed password can log in through the web interface without needing valid customer credentials.
What to do
On the FMC device, enter expert mode and run cat /var/log/messages | grep license. If you see a sudo entry referencing /var/tmp/license.tmp and package_info.pl, Cisco says this vulnerability may already have been exploited on your system.
There is no workaround, so install the Cisco hotfix for your release, Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar for FMC 7.0 or Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11 for FMC 7.2 from the Cisco Software Center, and rotate all credentials, keys, and certificates on the device since Cisco confirms active exploitation has occurred.
Technical details
Affected software: Cisco Secure Firewall Management Center, Cisco FMC
CVE-2026-20316 (CWE-259, use of hard-coded password) is a static-credential flaw in Cisco Secure FMC Software's web interface. An unauthenticated remote attacker can authenticate as a built-in low-privileged account and read sensitive data. CVSS base score is 5.3, but Cisco rates the Security Impact Rating as High because the low-privileged foothold can be chained with other FMC vulnerabilities for privilege escalation.
Cisco has confirmed active exploitation and published an IOC: an expert-mode log line showing sudo execution of package_info.pl against /var/tmp/license.tmp. No workaround exists; Cisco has released hotfixes for the 7.0 and 7.2 trains and recommends full credential rotation on affected devices.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact Low Some data can be read
- Integrity impact None No data tampering
- Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Open in FIRST.org calculator