Cisco has disclosed that a high-severity vulnerability affecting Secure Firewall Management Center (FMC) Software, has been actively exploited as a zero-day and has since been added to The U.S. Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-20316, is caused by hardcoded static credentials for a low-privilege account, enabling unauthenticated remote attackers to access affected FMC systems and potentially chain the vulnerability with other FMC flaws to escalate privileges and compromise devices. While Cisco has not identified the additional vulnerabilities being leveraged, it updated guidance for CVE-2026-20079 (a critical authentication bypass vulnerability that allows unauthenticated attackers to execute arbitrary scripts as root) and included the same /var/tmp/license.tmp indicator of compromise (IoC) in both advisories, suggesting the vulnerabilities may be chained despite Cisco stating it has not observed active exploitation of CVE-2026-20079. Cisco has released hotfixes for all supported FMC versions and advises organizations to apply them immediately, as no effective workarounds exist. CTIX analysts recommend following Cisco’s guidance and review system logs for the shared IoC, rotate all user credentials, keys, and certificates if compromise is suspected, and contact Cisco TAC for recovery assistance. CISA has directed Federal Civilian Executive Branch (FCEB) agencies to remediate CVE-2026-20316 by no later than August 1, 2026, underscoring the urgency of patching internet-exposed FMC deployments.