Cisco warns of FMC static credential flaw exploited in zero-day attacks

Cisco has disclosed two critical vulnerabilities in its Secure Firewall Management Center (FMC) software that were actively exploited in zero-day attacks. The first, CVE-2026-20316, involves static credentials for a low-privilege account that allow unauthenticated remote attackers to gain unauthorized access. The second, CVE-2026-20079, is a critical authentication bypass flaw enabling unauthenticated attackers to execute commands as root via crafted HTTP requests. Both vulnerabilities have been patched with hot fixes, but no workarounds exist. Indicators of compromise include the presence of '/var/tmp/license.tmp' in system logs, and organizations are advised to rotate credentials and contact Cisco TAC if compromised.

AI-extracted · verify before operational use