CVE-2026-20316 Cisco Secure FMC Hard-Coded Credential Zero-Day Exploited in Wild — CISA KEV August 1 Deadline; Critical Chain Partner CVE-2026-20079 (CVSS 10.0) Simultaneously Updated

Cisco confirmed active zero-day exploitation of CVE-2026-20316, a hard-coded static credential embedded in Cisco Secure Firewall Management Center (FMC) Software that allows unauthenticated remote attackers to log in and access sensitive network configuration data. While the standalone CVSS score is 5.3, Cisco assigned a High severity rating because the initial foothold chains with other FMC flaws to achieve full privilege escalation; a concurrent advisory update for CVE-2026-20079 — a CVSS 10.0 authentication bypass enabling arbitrary script execution as root — shares identical forensic indicators (/var/tmp/license.tmp), strongly suggesting attackers are combining both issues. CISA added CVE-2026-20316 to KEV on July 29 with a federal agency remediation deadline of August 1; Cisco states no workarounds exist and hot fixes for versions 7.0 through 10.0 are the only complete remediation.

CISA added CVE-2026-20316 to KEV on July 29 with a federal agency remediation deadline of August 1; Cisco states no workarounds exist and hot fixes for versions 7.0 through 10.0 are the only complete remediation.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.