Cisco Releases Hotfixes for Actively Exploited CVE-2026-20316 Zero-Day in Secure FMC Allowing Static Credential Access
A zero-day vulnerability tracked as CVE-2026-20316 is being actively exploited in Cisco Secure Firewall Management Center, enabling remote attackers to authenticate using hardcoded low-privilege credentials without prior authentication.
The flaw affects a critical component used in many corporate networks and carries a CVSS score of 5.3, yet Cisco has raised its internal severity rating to High because the initial access can be chained with additional vulnerabilities to expand privileges or reach elevated code execution.
Cisco has already distributed hotfixes for branches 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 with version-specific packages. Administrators are instructed to check license events in /var/log/messages and treat any appearance of the file /var/tmp/license.tmp as suspicious.
The same indicator is also associated with the related critical authentication bypass CVE-2026-20079, which may allow script execution to obtain root access. In environments exposed to both issues, patching should be performed as a combined remediation effort.
The most effective mitigation remains limiting exposure of the management interface to the internet by applying ACLs, VPN access and dedicated management networks. Organizations should also identify all FMC instances and their patch levels, rotate credentials and certificates after suspected activity, and enable telemetry focused on unusual sudo executions and commands involving license utilities such as paquete_info.pl.
U.S. federal civilian agencies have a remediation deadline of August 1, 2026 tied to the Known Exploited Vulnerabilities catalog.
Related articles
VK Introduces Security Gate: Internal AppSec Platform for Code, Dependency and Container Security
VK has detailed its internal Security Gate platform, which combines SAST, SCA, secret detection and container scanning to identify security issues across more than 40,000 repositories. The system applies custom prioritization rules, dynamic metadata analysis and an LLM-based triage module called VK Triage to reduce false positives and focus developer attention on exploitable findings. Security Gate integrates directly with corporate GitLab for automatic project onboarding, badge reporting and merge-request checks via the Fast Scanner service. It also monitors open-source dependencies for protestware, malware and reachable vulnerable methods, while supporting a wide range of languages including Python, Go, Java and Swift. Additional features include Jira linking, cross-branch triage, SBOM export and automated alerts through VK WorkSpace bots.
2.2 Million Line Vulnerability Report: What Happens After Discovery and How to Turn Findings Into Action
A massive vulnerability scan produced an 1,819-page report and a 2.2-million-row Excel file that exceeded spreadsheet limits, highlighting the gap between detection and remediation. The article explains that finding vulnerabilities accounts for only 10 percent of the work, while the remaining 90 percent involves prioritization, remediation, verification, and ensuring issues do not reappear. Research from BI.ZONE, Sber, Qualys, Cyentia Institute, Kenna Security, and Hadrian shows that organizations can typically remediate only one in ten open vulnerabilities per month and that Time-to-Exploit has dropped dramatically, with many edge-device flaws exploited on the day of disclosure. The piece stresses that continuous scanning, full infrastructure coverage including shadow IT, and separate high-frequency perimeter scans are essential because 85 percent of KEV-vulnerable assets remain unpatched at disclosure time. It recommends replacing bulky reports with concise, role-specific registries that answer four questions: what to do, where to do it, by when, and the consequences of inaction. Three legitimate outcomes for every vulnerability are outlined: patching, compensating controls, or formal risk acceptance with defined review dates, while false positives such as orphaned OpenSSL libraries must be cleaned rather than ignored.
Prepare for Summer Vacation: Patch Tuesday Overlaps with Obon Holiday Week Raises Risks
As August approaches and organizations enter summer vacation season, many will face a challenging overlap between Microsoft's Patch Tuesday and Japan's Obon holiday week in 2026. System administrators and security teams are often unavailable during extended breaks, leading to slower detection, reporting, and remediation of threats. Ransomware campaigns frequently target periods such as evenings, weekends, and consecutive holidays when response times are delayed. Experts recommend completing software updates on servers, network devices, and endpoints before departure to close known vulnerabilities. Security product definition files should be refreshed, unused systems powered down after risk assessment, and basic controls verified in advance. The advisory from Security NEXT highlights that dispersed vacation schedules in some organizations still leave concentrated risk windows for others.
Critical Remote Code Execution Flaw Patched in Veeam ONE Backup Management Product
Veeam Software disclosed six vulnerabilities in its backup environment operations management product Veeam ONE on July 29, 2026. The most severe issue, tracked as CVE-2026-64633, permits unauthenticated remote code execution on the agent host and received a maximum CVSS v4.0 base score of 10.0, rated Critical. A second flaw, CVE-2026-58075, allows unauthenticated arbitrary file reads that can lead to local privilege escalation and carries a CVSS score of 8.7. The vendor released updated versions addressing all six issues in Veeam ONE 13.1. Security researchers and administrators are urged to apply the patches immediately given the high severity and lack of authentication requirements for the critical vulnerability.