↓ Skip to main content
Purpleshift
  1. Active Vulnerability List/
  2. 2026/

CVE-2026-20131 | Cisco-FMC | RCE

FieldDetails
VulnerabilityCVE-2026-20131
SummaryA maximum-severity (CVSS 10.0) unauthenticated, remote code execution flaw in the web-based management interface of Cisco Secure Firewall Management Center (FMC) caused by insecure Java deserialization, letting a remote attacker run arbitrary code as root. It was exploited in the wild as a zero-day by the Interlock ransomware group before disclosure, is in CISA KEV (Known Ransomware Campaign Use), has a public PoC, and is now patched (no workaround).
Type / CWEUnauthenticated Remote Code Execution (RCE) via insecure deserialization of untrusted data. CWE-502: Deserialization of Untrusted Data.
Affected Products & VersionsCisco Secure Firewall Management Center (FMC) Software (on-premises) and Cisco Security Cloud Control (SCC) Firewall Management, regardless of device configuration.
Per the authoritative NVD CPE enumeration, affected releases span 6.4.0.13 through 10.0.0 across multiple trains: 6.4.0.13-6.4.0.18; 7.0.0-7.0.8.1; 7.1.0-7.1.0.3; 7.2.0-7.2.10.2; 7.3.0-7.3.1.2; 7.4.0-7.4.5; 7.6.0-7.6.4; 7.7.0 and 7.7.10-7.7.11; and 10.0.0. (Note: an early NVD HTML summary narrowed this to “7.0.5 through 7.4.1.1”; the broader CPE list is authoritative. Cisco publishes no static version table and defers to the Cisco Software Checker.)
Explicitly NOT affected (per Cisco): Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. SCC Firewall Management (SaaS) IS in scope but was patched server-side by Cisco with no customer action required.
Severity & ExploitabilityCVSS v3.1 Base Score: 10.0 (CRITICAL, maximum). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (assigned by Cisco, confirmed by NVD).
Plain-English: AV:N = exploitable over the network; AC:L = low complexity, no special conditions; PR:N = fully unauthenticated, no credentials; UI:N = no user interaction; S:C = Scope Changed (compromise of the FMC management plane crosses the security-authority boundary and extends to the firewalls it manages); C:H/I:H/A:H = total loss of confidentiality, integrity, and availability. A pre-auth, network-reachable, scope-changing RCE, the most severe possible profile.
CVSS v4.0: not published. NVD lists the v4.0 assessment as not yet provided.
DescriptionVendor/NVD quote: “A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device."
Gist: The FMC web UI insecurely deserializes a user-supplied Java byte stream; an attacker sends a crafted serialized Java object and achieves root-level RCE with no authentication. Advisory ID cisco-sa-fmc-rce-NKhnULJh; Cisco Bug ID CSCwt14636; first published 2026-03-04, last updated 2026-03-25.
Public PoC: YES. A public GitHub PoC exists (sak110/CVE-2026-20131) containing a detection probe (check.py) and a ysoserial-based exploit (poc.py); in-the-wild payloads were reported to have incorporated this PoC.
Root Cause & ExploitationRoot cause: The FMC web-based management interface accepts and deserializes an untrusted, user-supplied Java byte stream without validation (CWE-502). During object reconstruction a deserialization gadget chain executes, running attacker-chosen code as root. Cisco does not name the specific vulnerable class/method/endpoint, and the exact URL path/parameter is deliberately withheld by all primary sources. Public PoC tooling targets the web interface via HTTP POST carrying a native Java serialized object and a ysoserial-generated gadget chain.
Execution Flow:
1. Attacker reaches the network-exposed FMC web management interface (no auth, no user interaction).
2. Attacker crafts a malicious serialized Java object / gadget chain (e.g. via ysoserial) embedding an OS command payload.
3. Attacker POSTs the serialized blob to the vulnerable web endpoint. Inferred: the raw Java serialized stream begins with magic bytes AC ED 00 05 (base64 “rO0AB”).
4. FMC deserializes the stream and the gadget chain triggers during object reconstruction.
5. Arbitrary code executes as root, yielding full device compromise.
Representative payload (public-PoC level): an HTTP POST to the FMC web interface carrying a ysoserial gadget-chain payload; exact endpoint path not disclosed by Cisco.
Impact & SignificanceC:H/I:H/A:H with Scope CHANGED: a single FMC compromise is a control-plane breach. FMC is the central management console for Cisco Secure Firewall / Firepower deployments, so root on FMC can cascade to all firewalls it administers (high blast radius).
What the attacker gains: full root-level control of the management plane. Follow-on capability has been reported to include packet capture; dumping/exfiltrating configuration data and logs; creating backdoor accounts; altering firewall rules / access-control policies; disabling logging and alerts; and pivoting deeper into the managed network.
What is NOT achievable / limits: exploitation requires network reachability to the FMC web management interface. Cisco notes, and it has been widely reported, that the attack surface is reduced (not eliminated) if that interface has no public internet access; an attacker already on the internal/management network could still exploit it. There is no authentication, credential, or user-interaction precondition, so no “low-privilege only” limitation: the gain is directly root.
Why it matters: a maximum-severity pre-auth RCE on a security control plane, exploited as a zero-day by a ransomware operator, with a public PoC and a KEV listing.
Threat Activity / Abuse ScenariosConfirmed exploited in the wild as a zero-day before disclosure. Cisco PSIRT became aware of attempted exploitation in March 2026; the activity has been attributed to the Interlock ransomware group (high confidence), with first-observed exploitation reported around 2026-01-26, weeks before Cisco’s 2026-03-04 advisory; exploitation was separately observed from 2026-03-06.
CISA KEV: listed; dateAdded 2026-03-19; dueDate 2026-03-22; Known Ransomware Campaign Use = Known.
Generic abuse scenarios for this CVE (unauthenticated root on the firewall management plane): tamper with firewall policy / ACLs across every managed device; disable logging and defenses; steal device configuration and credentials; and use the trusted management plane to pivot deeper into the protected network. Note: actor-specific tooling and post-exploitation TTPs are campaign-dependent and out of scope here; see the threat-intel sources in References.
Detection & HuntingVendor signatures: Cisco Snort SIDs 66082 and 66083 (deploy/verify active on inline IPS in front of the FMC management interface); Zscaler ThreatLabz IPS signatures 6000322 “Java serialization Remote Command Execution” and 6000042 “Java Deserialization using YSoSerial tool detection” (generic Java-deserialization detection).
Exploit-traffic detection: alert on inbound requests to the FMC web management interface whose body carries the Java serialized-object magic bytes AC ED 00 05 (base64 prefix rO0AB), optionally with ysoserial gadget class names (e.g. CommonsCollections, java/lang/Runtime); and on anomalous binary HTTP POSTs to the management interface from untrusted sources.
Log sources: FMC web-management HTTP/HTTPS access logs; FMC application/Java logs for deserialization exceptions and stack traces; FMC host process/audit logs; perimeter netflow for connections initiated by the FMC appliance.
Inferred: because exploitation yields unauthenticated code execution as root, treat these as high-fidelity post-exploitation signals: the FMC Java/web process spawning child shells (sh, bash, curl, wget, python); unexpected outbound connections initiated by the FMC to unknown hosts shortly after a suspicious inbound request; new or unexpected local accounts on the FMC; and unexplained gaps in FMC logs or changes to firewall policy.
IOCs & IndicatorsThis CVE has no vendor-published atomic IOCs; exploitation is detected by signature and behavior (see Detection & Hunting). Generic exploitation indicators:
- Inferred: Java serialized-object stream magic bytes AC ED 00 05 (base64 prefix rO0AB) in an HTTP request body to the FMC web management interface (root cause is CWE-502 deserialization).
- Inferred: ysoserial gadget-chain class names in the payload, e.g. CommonsCollections, org.apache.commons.collections, java/lang/Runtime.
- A ysoserial-based public PoC exists (sak110/CVE-2026-20131); its probe (check.py) sends the magic bytes above.
Note: threat-actor C2, domains, and tooling hashes are campaign-specific (not properties of the CVE) and out of scope for this writeup; see the threat-intel sources in References for a given campaign’s IOCs.
MITRE ATT&CKCisco/NVD publish no official ATT&CK mapping. At the CVE level the relevant technique is:
- T1190 Exploit Public-Facing Application: unauthenticated insecure-deserialization RCE against the FMC web management interface.
Post-exploitation technique selection (execution, persistence, defense evasion, impact) depends on the threat actor and is campaign-dependent / out of scope for a CVE-level mapping.
Mitigation & StatusPATCHED. Cisco released free fixed software; the advisory states there are no workarounds, so upgrading is the only remediation. Advisory ID cisco-sa-fmc-rce-NKhnULJh (Bug ID CSCwt14636), first published 2026-03-04, last updated 2026-03-25.
Fixed builds: Cisco publishes no inline Fixed Releases table and directs customers to the Cisco Software Checker (https://sec.cloudapps.cisco.com/security/center/softwarecheckerportal/), which is authoritative for the exact first-fixed release per deployment. Note (secondary, aligned to the narrow “7.0.5-7.4.1.1” summary, reported): 7.0.x fixed in 7.0.6.3, 7.2.x in 7.2.5.1, 7.4.x in 7.4.2.1, all 6.x affected. Other secondary mappings reportedly disagree, so confirm via the Software Checker rather than any single secondary figure. SCC Firewall Management (SaaS) was already fixed by Cisco with no customer action required.
Hardening: remove direct internet reachability of the FMC web management interface and place it behind an identity-based zero-trust access layer; maintain a full FMC inventory and patch immediately. Cisco emphasizes patching is the only true remediation.
Solution status: patched. CISA KEV remediation due date: 2026-03-22.
References- https://nvd.nist.gov/vuln/detail/CVE-2026-20131
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
- https://sec.cloudapps.cisco.com/security/center/softwarecheckerportal/
- https://www.cisa.gov/news-events/alerts/2026/03/19/cisa-adds-one-known-exploited-vulnerability-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls
- https://www.zscaler.com/blogs/security-research/critical-remote-code-execution-vulnerability-cisco-secure-firewall
- https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20131/
- https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/
- https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-cisco-flaw-by-sunday/
- https://securityaffairs.com/189682/security/u-s-cisa-adds-a-flaw-in-cisco-fmc-and-cisco-scc-firewall-management-to-its-known-exploited-vulnerabilities-catalog.html
- https://github.com/sak110/CVE-2026-20131