Cisco Secure Firewall Management Center zero-day CVE-2026-20131 exploited by Interlock ransomware
A maximum-severity flaw (CVE-2026-20131) in Cisco Secure Firewall Management Center let anyone reach it over the network run code as root with no login. Interlock ransomware used it before the fix. Organisations running FMC should install Cisco's fixed release.
If your organisation or IT provider runs Cisco FMC, upgrade to a fixed release using Cisco's Software Checker, and keep the management interface off the public internet. Households do not run this product and have nothing to do.
What’s happening
CVE-2026-20131 is a flaw in the web management interface of Cisco Secure Firewall Management Center (FMC) software and Cisco Security Cloud Control (SCC) Firewall Management. An attacker with no login could send a booby-trapped Java object and run their own code as root. Cisco scored it 10.0 out of 10 and published fixed software on 4 March 2026. It says there is no workaround, and that ASA and FTD firewall software are not affected. Cisco says the SaaS-delivered SCC service has already been fixed. Amazon's research, as reported by Help Net Security, says the Interlock ransomware group began exploiting it on 26 January 2026, about five weeks before the fix. Cisco added exploitation to its advisory on 18 March and CISA listed the flaw as used in ransomware on 19 March. The exact fixed version numbers are in Cisco's advisory and Software Checker and were not confirmed here. No newer developments were found. This mainly affects organisations, not households.
- What
- Flaw
- Affects
- Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management
- Affected
- Cisco Secure Firewall Management Center (FMC) Software, regardless of device configuration
Cisco Security Cloud Control (SCC) Firewall Management - Fixed in
- Cisco fixed FMC software releases (see Cisco Software Checker for your version)
SCC Firewall Management: fixed by Cisco in the SaaS service; hot fix noted 2026-03-25 - Since
- 4 Mar 2026
- Closed
- 25 Mar 2026
Timeline
- Vendor revisedFixed
Cisco's final advisory revision (1.2) noted a hot fix is available for Cisco SCC Firewall Management. Cisco states the SaaS service itself is already fixed.
- CISA added
CISA added CVE-2026-20131 to its Known Exploited Vulnerabilities list, marking it as used in ransomware, with a federal deadline of 22 March 2026.
- Wider attacks
Cisco revised its advisory to say its PSIRT knew of attempted exploitation. Amazon published findings that Interlock had used the flaw as a zero-day for about 36 days before disclosure.
- Made publicFixed
Cisco published its advisory for CVE-2026-20131, a CVSS 10.0 flaw in Secure Firewall Management Center and Security Cloud Control Firewall Management, and released fixed software. Cisco listed no workaround.
- Update
Amazon's research, as relayed by Help Net Security, puts the start of Interlock ransomware attacks on this flaw at 26 January 2026, before any fix existed.
Sources
- Cisco Secure Firewall Management Center RCE (cisco-sa-fmc-rce-NKhnULJh)Cisco · 25 Mar 2026
- Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)Help Net Security · 20 Mar 2026
- U.S. CISA adds a flaw in Cisco FMC and Cisco SCC Firewall Management to its Known Exploited Vulnerabilities catalogSecurity Affairs · 19 Mar 2026