Cisco FMC Backdoor Account Under Active Attack as CISA Sets August 1 Patch Deadline
Cisco disclosed on July 29 that attackers are actively exploiting a hard-coded account baked into Secure Firewall Management Center (FMC), the console that controls firewall policies across Firepower deployments. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, tracked as CVE-2026-20316, to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave federal civilian agencies until August 1 to apply fixes.
The catch: there is no workaround. Cisco says the only remedy is a branch-specific hotfix, and any FMC whose management interface is reachable from the internet should be treated as potentially compromised until that hotfix lands and a log check comes back clean.
A backdoor account that ships with every FMC
CVE-2026-20316 is a "use of hard-coded password" flaw, cataloged as CWE-259. A static set of credentials for a low-privilege account is compiled directly into FMC software across six release branches: 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Anyone who can reach the management interface over the network can log in with those credentials, no guessing, no brute force, and no prior access required.
"This vulnerability is due to the presence of static user credentials for a low-privileged account," Cisco said in its advisory. "An attacker could exploit this vulnerability by using the account to log in to an affected system."
What makes the account worse than a typical weak password is that password rotation does not touch it. The credential lives inside the application binary, not the user database, so an organization can change every admin password on the box and the backdoor still works. Security researcher Jimi Sebree of Horizon3.ai found and reported the flaw; Cisco credits him in the advisory.
A successful login grants read access to sensitive data: firewall access control policies, VPN gateway configurations, the inventory of managed Firepower Threat Defense (FTD) sensors, and the network topology of the whole security estate. That is a detailed map of where every firewall sits and what it protects.
Why a 5.3 score is being treated as an emergency
CVE-2026-20316 carries a CVSS score of 5.3, which normally reads as medium severity. Cisco still assigned it a High Security Impact Rating, and the reason is the company's own advisory: the backdoor can be chained with other FMC flaws to escalate privileges.
The partner in that chain is CVE-2026-20079, an authentication bypass in FMC first disclosed in March with a perfect CVSS score of 10.0. It lets an unauthenticated remote attacker execute arbitrary commands as root on the Linux-based appliance with specially crafted HTTP requests. Cisco updated that advisory on July 29 with a second bug ID, the same indicators of compromise, and hotfixes for both issues in one bundle.
The practical attack path looks like this. An attacker scans for internet-exposed FMC management interfaces on TCP ports 443, 4505, and 8305, fingerprints the version from banner strings, logs in with the static credential, and reads the configuration. From that low-privilege session they can enumerate every downstream FTD sensor. Then the CVE-2026-20079 bypass converts that foothold into root command execution.
A third flaw, CVE-2026-20131, also rated CVSS 10.0 and confirmed exploited per AWS threat intelligence reporting as of July 29, sits in the same advisory bundle. RunZero, which published a technical breakdown of the disclosure, notes that the exact relationship between the two critical bugs remains unclear, but that both were addressed with the same hotfixes.
With root on the FMC, an attacker controls the security control plane itself. They can open inbound access rules, disable intrusion prevention signatures against specific traffic, suppress security event logging to erase forensic visibility, create new management accounts, and drop a persistent backdoor that survives the patch. The firewall guards everything behind it, and the FMC guards the firewall.
One command tells you if you were hit
Cisco published a single host-based indicator of compromise, and checking it takes under a minute per appliance. In expert mode, run:
cat /var/log/messages | grep license
If the output includes a line with /var/tmp/license.tmp showing the www process invoking package_info.pl as root, the static credential was likely used on that device. A sample log entry published by Cisco shows exactly that shape: a sudo call from user www to /usr/local/sf/bin/package_info.pl with /var/tmp/license.tmp as an argument.
Any positive hit means the appliance is compromised, not just vulnerable. Cisco's guidance, echoed by The Hacker News and SecurityWeek, is to rotate every credential, API key, VPN certificate, and integration secret that touches the FMC before returning it to service, and to check whether downstream firewall policies were altered.
Cisco has not said when the attacks began, who is behind them, or which organizations were targeted. It acknowledged the exploitation began earlier this month.
The hotfixes and the deadline
CISA added CVE-2026-20316 to the KEV catalog on July 29, citing confirmed active exploitation, and the agency's Binding Operational Directive 26-04 compresses the remediation window for federal civilian agencies to days. The listed due date is August 1, 2026.
The fixed builds, all hotfixes rather than full releases:
- FMC 10.0 — Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar
- FMC 7.7 — Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
- FMC 7.6 — Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
- FMC 7.4 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
- FMC 7.2 — Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
- FMC 7.0 — Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
Organizations outside the federal government should not assume the deadline does not apply to them. CISA urges every organization to treat KEV-listed flaws as an emergency, and active exploitation began before the disclosure date. Three days is a short patch window for a management-plane bug with confirmed zero-day use, which is exactly the point.
Who is actually at risk
FMC is not a niche product. It is the tier-1 management platform for Firepower deployments across federal agencies, financial institutions, healthcare systems, and large enterprises, and the six affected branches cover every actively supported FMC release line as of July 2026. That means the exposure is measured in thousands of appliances, and the affected versions span the full supported range, so there is no "upgrade to a safe old version" escape hatch.
Internet-exposed management interfaces are the primary target, but not the only one. RunZero's analysis notes that an attacker with access to the management VLAN, a compromised internal workstation, or a VPN connection can hit the static credential from inside the perimeter. Restricting external access shrinks the attack surface; it does not remove the backdoor.
What to do now
The urgent steps are the boring ones. Restrict the FMC management interface so it accepts connections only from trusted management networks, and block ports 443, 4505, and 8305 from external IPs at the perimeter. Cisco itself notes that the attack surface shrinks sharply when the management interface has no public internet access. Run the license grep on every FMC appliance before and after patching, and route FMC syslog to a SIEM so the www-to-package_info.pl pattern can trigger an alert.
RunZero suggests a simple inventory query for locating potentially exposed boxes: vendor:=Cisco AND product:=FMC in its software inventory. For organizations that manage FMC appliances through partners or managed security providers, the question to ask the provider today is whether the hotfix is installed.
This is the same story arc as recent management-interface attacks: a SonicWall SMA1000 zero-day, a Qilin ransomware campaign against PAN-OS GlobalProtect, and exploited Cisco Catalyst SD-WAN and Unified Communications Manager flaws all targeted the consoles that sit above the security controls. An attacker who owns the management plane owns the defenses underneath it.
The pattern matters for defenders in any industry. Network security appliances are a favorite target precisely because they are trusted, privileged, and often internet-exposed. CVE-2026-20316 is a reminder that the credentials embedded in that trust can be the weakest link. Patch, segment, and check the logs before you assume the firewall is still yours.
For more on how exploited flaws in enterprise products are handled, see our Cybersecurity section and the CISA SharePoint alert we covered earlier this week.