CVE-2026-20131
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability - [Actively Exploited]
Description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
INFO
Published Date :
March 4, 2026, 6:16 p.m.
Last Modified :
March 23, 2026, 12:56 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known Detected Mar 20, 2026
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131
Affected Products
The following products are affected by CVE-2026-20131
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Update Cisco Secure Firewall Management Center Software to the latest version.
- Restrict public internet access to the FMC management interface.
- Apply all available security patches from the vendor.
Public PoC/Exploit Available at Github
CVE-2026-20131 has a 6 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-20131.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-20131 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-20131
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
None
Python Java
CVE-2026-20131 — Cisco FMC Insecure Java Deserialization (RCE)
Python
None
PowerShell Shell
None
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-20131 vulnerability anywhere in the article.
-
The Hacker News
⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More
Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a ... Read more
-
Help Net Security
Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)
Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The company did not say whethe ... Read more
-
Daily CyberSecurity
The Weekly Breach: 7 Maximum CVSS Flaws and the DarkSword Exploit Unveiled
The past seven days have been an exceptionally busy period for cybersecurity defenders. Between March 16 and March 23, a staggering 1,348 new vulnerabilities were identified and logged. While the shee ... Read more
-
Help Net Security
Week in review: ScreenConnect servers open to attack, exploited Microsoft SharePoint flaw
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What smart factories keep getting wrong about cybersecurity In this Help Net Security interview, Packs ... Read more
-
TheCyberThrone
CISA adds Five Vulnerabilities to KEV Catalog- March 20, 2026
OverviewCISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on March 20, 2026, with a remediation due date of April 3, 2026 for all entries. The batch spans three Apple ecos ... Read more
-
Help Net Security
Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)
A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransom ... Read more
-
SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 12
The Good | Operation Synergia III Disrupts Malicious Networks & the EU Sanctions State-Sponsored Attackers Operation Synergia III, an Interpol-led crackdown spanning July 2025 to January 2026, has dis ... Read more
-
CybersecurityNews
CISA Warns of Cisco Secure Firewall Management Center 0-Day Exploited in Ransomware Attacks
CISA Warns Cisco Secure Firewall Management Center 0-Day Exploit An urgent warning highlights a critical zero-day in Cisco products, now added to the CISA Known Exploited Vulnerabilities Catalog after ... Read more
-
TheCyberThrone
CISA Adds CVE-2026-20131 to KEV that was Weaponized for 36 Days
A maximum-severity RCE flaw in Cisco’s Secure Firewall Management Center was silently weaponized by the Interlock ransomware group for over a month before anyone knew it existed — a textbook pre-discl ... Read more
-
The Cyber Express
Android Malware Campaign Targets Indian Users via Fake eChallan Alerts
A new Android malware campaign targeting Indian users has been reported by the Indian Computer Emergency Response Team, CERT-In. According to the agency, multiple reports indicate a coordinated effort ... Read more
-
The Cyber Express
Pixel Watch Users Report Inflated Steps, Missing SpO2 Data
A recent Pixel firmware update released in March 2026 has sparked concern among Pixel Watch users, as reports of inaccurate Fitbit tracking, missing SpO2 readings, and inflated activity data continue ... Read more
-
Daily CyberSecurity
Critical Jenkins Flaws Expose CI/CD Servers to Remote Code Execution
The Jenkins project has released a critical security advisory addressing multiple vulnerabilities that could lead to full system compromise. The advisory highlights two high-severity flaws in the Jenk ... Read more
-
Daily CyberSecurity
High-Severity RCE Flaw in Atlassian Bamboo Threatens CI/CD Environments
Atlassian has sounded the alarm for users of its Bamboo Data Center, uncovering a high-severity Remote Code Execution (RCE) vulnerability that could allow attackers to seize control of development env ... Read more
-
Daily CyberSecurity
CISA Issues Urgent Warning Following Global Cyberattack on Stryker
In a move to protect the nation’s critical infrastructure, the Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert following a significant cyberattack on Stryker Corporation, a ... Read more
-
The Cyber Express
Interlock Ransomware Leveraged Cisco FMC Zero-Day 36 Days Before Patch
Amazon’s threat intelligence teams have uncovered a new cyber campaign linked to the Interlock ransomware group. The campaign centers around a flaw affecting Cisco Secure Firewall Management Center (F ... Read more
-
The Cyber Express
Apple Patches WebKit Vulnerability CVE-2026-20643 Across iOS, macOS
Apple has released a new security update to address a critical WebKit vulnerability tracked as CVE-2026-20643. The vulnerability was identified as a cross-origin issue within the Navigation API of Web ... Read more
-
The Hacker News
CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged government agencies to apply patches for two security flaws impacting Synacor Zimbra Collaboration Suite (ZCS) and Microsoft ... Read more
-
Daily CyberSecurity
Exploited in the Wild: CISA Warns of Active Attacks on Microsoft SharePoint and Zimbra
The Cybersecurity and Infrastructure Security Agency (CISA) has officially expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding two high-risk flaws that are currently being weaponized by ... Read more
-
Daily CyberSecurity
Exploited in the Wild: Interlock Ransomware Weaponizes Critical 10.0 CVSS Cisco Zero-Day
Interlock ransomware Amazon threat intelligence has uncovered an active Interlock ransomware campaign that exploited a critical vulnerability in Cisco Secure Firewall Management Center (FMC) as a zero ... Read more
-
CybersecurityNews
Cisco Firewall 0-day Vulnerability Exploited in the Wild to Deploy Interlock Ransomware
An active campaign by the Interlock ransomware group is exploiting a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) Software. Cisco disclosed the fla ... Read more
The following table lists the changes that have been made to the
CVE-2026-20131 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Mar. 23, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Mar. 20, 2026
Action Type Old Value New Value Changed Description A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. -
Initial Analysis by [email protected]
Mar. 19, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.3.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.5:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.4:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.7:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.6:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.7:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.7.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.9:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.6.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:10.0.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.4:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.4:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.4.5:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.6.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.6.3:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.6.4:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10.1:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_firewall_management_center:7.7.11:*:*:*:*:*:*:* Added Reference Type Cisco Systems, Inc.: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh Types: Vendor Advisory Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131 Types: US Government Resource Added Reference Type CISA-ADP: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/ Types: Technical Description -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 19, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 19, 2026
Action Type Old Value New Value Added Reference https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/ -
New CVE Received by [email protected]
Mar. 04, 2026
Action Type Old Value New Value Added Description A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-502 Added Reference https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh