{"id":"cisco-fmc-deserialization-rce-interlock-mar-2026","category":"patch","status":"closed","title":"Cisco Secure Firewall Management Center zero-day CVE-2026-20131 exploited by Interlock ransomware","tldr":"A maximum-severity flaw (CVE-2026-20131) in Cisco Secure Firewall Management Center let anyone reach it over the network run code as root with no login. Interlock ransomware used it before the fix. Organisations running FMC should install Cisco's fixed release.","summary":"CVE-2026-20131 is a flaw in the web management interface of Cisco Secure Firewall Management Center (FMC) software and Cisco Security Cloud Control (SCC) Firewall Management. An attacker with no login could send a booby-trapped Java object and run their own code as root. Cisco scored it 10.0 out of 10 and published fixed software on 4 March 2026. It says there is no workaround, and that ASA and FTD firewall software are not affected. Cisco says the SaaS-delivered SCC service has already been fixed. Amazon's research, as reported by Help Net Security, says the Interlock ransomware group began exploiting it on 26 January 2026, about five weeks before the fix. Cisco added exploitation to its advisory on 18 March and CISA listed the flaw as used in ransomware on 19 March. The exact fixed version numbers are in Cisco's advisory and Software Checker and were not confirmed here. No newer developments were found. This mainly affects organisations, not households.","action":"If your organisation or IT provider runs Cisco FMC, upgrade to a fixed release using Cisco's Software Checker, and keep the management interface off the public internet. Households do not run this product and have nothing to do.","product":"Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20131"],"tags":["cisco","fmc","firewall","zero-day","ransomware","interlock","deserialization","cisa-kev"],"affected":["Cisco Secure Firewall Management Center (FMC) Software, regardless of device configuration","Cisco Security Cloud Control (SCC) Firewall Management"],"fixed":["Cisco fixed FMC software releases (see Cisco Software Checker for your version)","SCC Firewall Management: fixed by Cisco in the SaaS service; hot fix noted 2026-03-25"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Secure Firewall Management Center RCE (cisco-sa-fmc-rce-NKhnULJh)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh","by":"Cisco","date":"2026-03-25"},{"kind":"news","title":"Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)","url":"https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/","by":"Help Net Security","date":"2026-03-20"},{"kind":"news","title":"U.S. CISA adds a flaw in Cisco FMC and Cisco SCC Firewall Management to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/189682/security/u-s-cisa-adds-a-flaw-in-cisco-fmc-and-cisco-scc-firewall-management-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","date":"2026-03-19"}],"started":"2026-03-04","closed":"2026-03-25","created":"2026-11-03T22:03:12.463Z","updated":"2026-11-03T22:03:12.463Z","cve_notes":[{"cve":"CVE-2026-20131","name":"Unsafe deserialization in Cisco FMC web interface","what":"An unsafe-deserialization flaw in the web management interface of Cisco Secure Firewall Management Center and SCC Firewall Management that lets an unauthenticated remote attacker send a crafted Java object and run code as root.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-03-25","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"Cisco's final advisory revision (1.2) noted a hot fix is available for Cisco SCC Firewall Management. Cisco states the SaaS service itself is already fixed.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh","by":"Cisco","patch":"patched"},{"at":"2026-03-19","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-20131 to its Known Exploited Vulnerabilities list, marking it as used in ransomware, with a federal deadline of 22 March 2026.","url":"https://securityaffairs.com/189682/security/u-s-cisa-adds-a-flaw-in-cisco-fmc-and-cisco-scc-firewall-management-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","patch":null},{"at":"2026-03-18","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Cisco revised its advisory to say its PSIRT knew of attempted exploitation. Amazon published findings that Interlock had used the flaw as a zero-day for about 36 days before disclosure.","url":"https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/","by":"Help Net Security","patch":null},{"at":"2026-03-04","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Cisco published its advisory for CVE-2026-20131, a CVSS 10.0 flaw in Secure Firewall Management Center and Security Cloud Control Firewall Management, and released fixed software. Cisco listed no workaround.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh","by":"Cisco","patch":"patched"},{"at":"2026-01-26","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Amazon's research, as relayed by Help Net Security, puts the start of Interlock ransomware attacks on this flaw at 26 January 2026, before any fix existed.","url":"https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/","by":"Help Net Security","patch":null}],"url":"https://hard.fyi/live/cisco-fmc-deserialization-rce-interlock-mar-2026/","json":"https://hard.fyi/api/live?id=cisco-fmc-deserialization-rce-interlock-mar-2026"}