Detect Cisco Secure Firewall Management Center Hard-coded Credential Exploitation (CVE-2026-20316) in IBM QRadar
Detects exploitation attempts and successful authentication against Cisco Secure Firewall Management Center (FMC) using an undocumented, hard-coded static credential (CVE-2026-20316, CWE-259). This flaw is listed in CISA KEV and has been exploited in zero-day attacks per Cisco and public reporting. Detection focuses on FMC authentication logs, management-interface access from unexpected sources, and post-authentication administrative actions consistent with abuse of a built-in account.
MITRE ATT&CK
QRadar Detection Query
SELECT DEVICENAME(deviceid) as Device, sourceip, username, eventcount, starttime, endtime
FROM events
WHERE devicetype = 'Cisco Firewall Management Center'
AND (QIDNAME(qid) ILIKE '%login%' OR QIDNAME(qid) ILIKE '%authentication%')
AND (username ILIKE '%admin%' OR username ILIKE '%support%' OR username ILIKE '%maintenance%' OR username ILIKE '%cisco%' OR username ILIKE '%root%' OR username ILIKE '%backdoor%')
LAST 24 HOURSQRadar AQL query to surface FMC authentication events tied to generic or maintenance account names consistent with hard-coded credential abuse.
Data Sources
Required Tables
False Positives & Tuning
- Approved administrative access via known support accounts
- Scheduled service account authentications
- Penetration testing activity using shared test credentials
Other platforms for CVE-2026-20316
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate FMC Login with Generic Maintenance Account Name
Expected signal: HTTP POST authentication request logged in FMC syslog/audit log with account name 'maintenance' and source IP of the lab test host.
- Test 2Simulate Repeated Login Attempts from Multiple Source IPs
Expected signal: Multiple authentication log entries for account 'admin' with distinct source IP addresses within a short time window.
- Test 3Simulate Post-Login Configuration Change
Expected signal: FMC audit log entry showing policy creation/modification action correlated with the prior simulated login session.
References (5)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-20316
- https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/
Response Playbook
Triage
- Verify whether the observed authentication event used a known FMC built-in/maintenance account name and correlate source IP against expected administrative ranges (VPN, jump box, management VLAN).
- Check Cisco's advisory (cisco-sa-fmc-static-cred-BET3Cjh) for the specific affected FMC software versions and confirm whether the target appliance is running an unpatched version.
- Review FMC audit logs and web UI access logs for post-login administrative actions (policy changes, user creation, access control modifications) immediately following the suspicious login.
- Determine if the FMC management interface is internet-facing or otherwise reachable from untrusted networks, which significantly raises exploitation likelihood.
Containment
- Immediately restrict network access to the FMC management interface to a trusted management network or VPN, blocking any internet-facing exposure.
- Apply the Cisco security patch/hotfix referenced in cisco-sa-fmc-static-cred-BET3Cjh as soon as available, or apply vendor-recommended mitigations if a patch is not yet released.
- Rotate all local administrative and service account credentials on the affected FMC instance, and disable/remove any unused default or maintenance accounts if permitted by Cisco guidance.
- Isolate the FMC from managed firewall sensors temporarily if compromise is confirmed, to prevent lateral pushing of malicious policy changes to managed devices.
Evidence Collection
- Export FMC audit logs, authentication logs, and system logs covering the suspected exploitation window for forensic review.
- Capture configuration snapshots (access control policies, user accounts, API keys) before and after the suspected incident to identify unauthorized changes.
- Collect network flow/packet capture data for connections to the FMC management interface from the source IP(s) involved in suspicious logins.
- Preserve any command history or CLI session logs from the FMC appliance for chain-of-custody documentation.
Escalation Criteria
- !Confirmed successful authentication using the hard-coded/static credential from an untrusted or unexpected source IP.
- !Evidence of post-authentication changes to firewall access control policies, user accounts, or managed device configurations.
- !FMC management interface found exposed to the internet without compensating controls (per CISA BOD 26-04 guidance on internet-facing management interfaces).
- !Indicators the FMC is managing production firewalls protecting critical infrastructure or high-value assets, warranting incident response escalation per CISA KEV/BOD 26-04 timelines.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
FMC authentication and audit logs (/var/log or equivalent on the FMC appliance) - >
Web UI session logs and API access tokens issued around the time of suspected compromise - >
Configuration change history within FMC's policy management database - >
Network device logs (firewalls, load balancers) showing connections to the FMC management port (typically TCP 443)
Tuning Guidance
Baseline the known list of legitimate FMC administrative and maintenance account names in your environment and suppress alerts for logins from documented, approved management IP ranges. Because the hard-coded account name has not been publicly disclosed in the correlated intel, initially tune detections broadly around generic/support-style account naming and known management-interface access patterns, then narrow using the exact account name once Cisco's advisory details are confirmed. Prioritize alerting on internet-facing or unexpected-source logins over internal management-network activity to reduce noise.
Hunting Queries
30-day historical hunt for FMC accounts authenticating from an unusually high number of distinct source IPs, which may indicate distributed exploitation attempts using the shared hard-coded credential.
CommonSecurityLog
| where DeviceProduct has_any ("Firewall Management Center", "FMC")
| where TimeGenerated > ago(30d)
| summarize LoginAttempts=count(), DistinctIPs=dcount(SourceIP) by SourceUserName
| where DistinctIPs > 3
| order by LoginAttempts descindex=cisco sourcetype=cisco:fmc:syslog earliest=-30d
| stats count as LoginAttempts, dc(src_ip) as DistinctIPs by user
| where DistinctIPs > 3
| sort - LoginAttemptsAtomic Red Team Tests
Simulates an authentication event to a mock Cisco FMC-style web login endpoint using a generic maintenance/support account name to validate log ingestion and detection logic.
Command
curl -s -k -X POST https://lab-fmc.internal/api/fmc_platform/v1/auth/generatetoken -H 'Authorization: Basic bWFpbnRlbmFuY2U6dGVzdHBhc3M=' -o /tmp/fmc_login_test.logCleanup
rm -f /tmp/fmc_login_test.logExpected Telemetry
HTTP POST authentication request logged in FMC syslog/audit log with account name 'maintenance' and source IP of the lab test host.
Expected Detection
KQL/SPL rules matching generic account name patterns (admin|support|maintenance|cisco|root|backdoor) should trigger on the simulated login event.
Generates repeated authentication attempts against a lab FMC endpoint from multiple simulated source IPs to validate the hunting query for distributed credential abuse.
Command
for ip in 10.10.10.1 10.10.10.2 10.10.10.3 10.10.10.4; do curl -s -k -X POST https://lab-fmc.internal/api/fmc_platform/v1/auth/generatetoken -H 'Authorization: Basic YWRtaW46dGVzdHBhc3M=' --interface $ip -o /dev/null; doneCleanup
No persistent changes; ensure lab endpoint logs are rotated/cleared per test lab procedures.Expected Telemetry
Multiple authentication log entries for account 'admin' with distinct source IP addresses within a short time window.
Expected Detection
Hunting query identifying accounts with DistinctIPs > 3 should flag the simulated account as anomalous.
After a simulated login, performs a mock configuration change API call to validate detection of post-authentication administrative activity consistent with abuse of the hard-coded credential.
Command
curl -s -k -X POST https://lab-fmc.internal/api/fmc_config/v1/domain/default/policy/accesspolicies -H 'Authorization: Bearer TEST_TOKEN' -d '{"name":"test-policy-change"}' -o /tmp/fmc_config_test.logCleanup
rm -f /tmp/fmc_config_test.log; revert any test policy objects created in the lab FMC instance.Expected Telemetry
FMC audit log entry showing policy creation/modification action correlated with the prior simulated login session.
Expected Detection
Triage playbook step verifying post-login administrative actions should surface the simulated policy change for correlation with the suspicious login event.