Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

Summary: CISA added CVE-2026-20316, a CVSS 5.3 flaw in Cisco Secure Firewall Management Center Software caused by static user credentials for a low-privileged account, to its Known Exploited Vulnerabilities catalog on Wednesday after reports of zero-day exploitation. Cisco, which credited Horizon3.ai researcher Jimi Sebree with discovering the flaw, rated it High rather than Medium because it can be chained with other FMC vulnerabilities to elevate privileges, and pointed to the /var/tmp/license.tmp indicator as a sign of possible exploitation.
What's compelling: The same /var/tmp/license.tmp indicator now appears in advisories for both this bug and CVE-2026-20079, a CVSS 10.0 authentication bypass that yields root access, so an attacker who lands the low-privileged account may be one chain away from code execution on your firewall management plane.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20079 CVE-2026-20316
Related: Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware Cyber Risks ·
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities Cyber Risks ·
CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026