CVE-2026-20131criticalunder attackransomwareCWE-502

CVE-2026-20131: critical vulnerability in Cisco Secure Firewall Management Center (FMC)

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

Published · Updated

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 10epss 43%
from disclosure to weapon67 days
Published on NVDMar 4
1st PoC+67d
CISA KEV+15d
exploitation probability
43%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 21/2026Vulnerabilidade crítica no Cisco Secure Firewall Management Center (FMC)read on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-03-22

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Cisco Secure Firewall Management Center allows anyone on the network to send a specially crafted message that makes the device run malicious code with full administrator privileges, without needing to log in first.

Technical detail

Insecure deserialization of untrusted Java objects in the web-based management interface permits unauthenticated remote code execution as root. An attacker sends a crafted serialized Java byte stream to trigger arbitrary command execution; exposure is reduced if the management interface lacks public internet routing.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Cisco · Cisco Secure Firewall Management Center (FMC)
public PoCs found — 1
githubgithub.com/0xBlackash/CVE-2026-20131★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Secure Firewall Management Center (FMC)

In the same product, most dangerous first.

CVE-2026-20079CRITICALCisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityEPSS 88.5%KEVCVE-2026-20316MEDIUMCisco Secure Firewall Management Center Software Static Credential VulnerabilityEPSS 35.1%KEVCVE-2026-20242CRITICALCisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-20340HIGHCisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution VulnerabilityEPSS 0.7%CVE-2026-20343HIGHCisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service VulnerabilityEPSS 0.7%CVE-2026-20324CRITICALCisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution VulnerabilityEPSS 0.6%
References
https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJhhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131