Cisco Secure Firewall Management Center Hard-coded Credential Exploitation (CVE-2026-20316)

// Requires Cisco FMC/Secure Firewall syslog ingested via CommonSecurityLog or custom table
CommonSecurityLog
| where DeviceVendor == "Cisco" and DeviceProduct has_any ("Firewall Management Center", "FMC", "Secure Firewall")
| where Activity has_any ("Login", "Authentication", "auth")
| extend AccountName = tostring(SourceUserName)
| where AccountName has_any ("admin", "support", "maintenance", "cisco", "root", "backdoor")
| summarize LoginCount = count(), SourceIPs = make_set(SourceIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by AccountName, DeviceName, DestinationIP
| where LoginCount >= 1
| order by LastSeen desc

index=cisco sourcetype=cisco:fmc:syslog (Activity="Login" OR Activity="Authentication")
| eval AccountName=coalesce(user, src_user)
| where match(AccountName, "(?i)(admin|support|maintenance|cisco|root|backdoor)")
| stats count as LoginCount, values(src_ip) as SourceIPs, min(_time) as FirstSeen, max(_time) as LastSeen by AccountName, dest, host
| where LoginCount >= 1
| convert ctime(FirstSeen) ctime(LastSeen)
| sort - LastSeen

authentication where event.dataset == "cisco.fmc" and
  event.action in ("user_login", "authentication_success", "authentication_attempt") and
  (user.name : "admin" or user.name : "support" or user.name : "maintenance" or user.name : "cisco" or user.name : "root" or user.name : "backdoor")

SELECT DEVICENAME(deviceid) as Device, sourceip, username, eventcount, starttime, endtime
FROM events
WHERE devicetype = 'Cisco Firewall Management Center'
AND (QIDNAME(qid) ILIKE '%login%' OR QIDNAME(qid) ILIKE '%authentication%')
AND (username ILIKE '%admin%' OR username ILIKE '%support%' OR username ILIKE '%maintenance%' OR username ILIKE '%cisco%' OR username ILIKE '%root%' OR username ILIKE '%backdoor%')
LAST 24 HOURS

_sourceCategory=cisco/fmc
| parse "user=* " as account_name
| where account_name matches "*admin*" or account_name matches "*support*" or account_name matches "*maintenance*" or account_name matches "*cisco*" or account_name matches "*root*" or account_name matches "*backdoor*"
| count by account_name, src_ip, dest_ip
| sort -_count

rule cisco_fmc_hardcoded_cred_login {
  meta:
    author = "df00tech"
    description = "Detects login to Cisco FMC using accounts associated with hard-coded credential CVE-2026-20316"
    severity = "CRITICAL"
  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.principal.application = "Cisco Secure Firewall Management Center"
    $login.target.user.userid = /(?i)(admin|support|maintenance|cisco|root|backdoor)/
  condition:
    $login
}

#event_simpleName=NetworkAppliance* OR #event_simpleName=AuthActivity
| ProductName="*Firewall Management Center*" OR ProductName="*FMC*"
| in(field=UserName, values=["admin", "support", "maintenance", "cisco", "root", "backdoor"], ignoreCase=true)
| table([timestamp, UserName, SourceIP, DeviceName, EventType])
| sort(timestamp, order=desc)