CVE-2026-20131
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-20131 is a critical unauthenticated remote code execution vulnerability in the Cisco Firepower Management Center (FMC) web management interface. The flaw arises from insecure deserialization of Java byte streams, allowing an unauthenticated remote attacker to execute arbitrary Java code as root on the underlying operating system. With a maximum CVSS v3.1 score of 10.0 and an EPSS score of 0.58%, CVE-2026-20131 represents an extreme risk to any organization running an affected FMC instance. CISA added CVE-2026-20131 to the Known Exploited Vulnerabilities catalog on March 19, 2026, with an expedited remediation deadline of March 22, 2026. This vulnerability has a confirmed association with ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure firewall management center | 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.4.0.17; 6.4.0.18; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.0.6; 7.0.6.1; 7.0.6.2; 7.0.6.3; 7.0.7; 7.0.8; 7.0.8.1; 7.1.0; 7.1.0.1; 7.1.0.2; 7.1.0.3; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.2.3.1; 7.2.4; 7.2.4.1; 7.2.5; 7.2.5.1; 7.2.5.2; 7.2.6; 7.2.7; 7.2.8; 7.2.8.1; 7.2.9; 7.2.10; 7.2.10.1; 7.2.10.2; 7.3.0; 7.3.1; 7.3.1.1; 7.3.1.2; 7.4.0; 7.4.1; 7.4.1.1; 7.4.2; 7.4.2.1; 7.4.2.2; 7.4.2.3; 7.4.2.4; 7.4.3; 7.4.4; 7.4.5; 7.6.0; 7.6.1; 7.6.2; 7.6.2.1; 7.6.3; 7.6.4; 7.7.0; 7.7.10; 7.7.10.1; 7.7.11; 10.0.0 |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh(Vendor Advisory)
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/(Technical Description)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2026-20131 is classified under CWE-502 (Deserialization of Untrusted Data). This weakness occurs when an application deserializes data from an untrusted source without sufficient validation, enabling an attacker to inject malicious serialized objects that execute arbitrary code upon deserialization.
In CVE-2026-20131, the Cisco FMC web management interface accepts serialized Java byte streams from unauthenticated users. The deserialization process does not employ object type filtering or integrity validation, meaning an attacker can submit a crafted serialized Java object containing a gadget chain that triggers arbitrary command execution. Because the FMC web service runs with root privileges, successful exploitation grants the attacker full control of the appliance.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2026-20131 carries the maximum possible CVSS v3.1 base score of 10.0 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Every metric is at its worst-case value: the attack is network-accessible with low complexity, requires no privileges or user interaction, and the scope is Changed, meaning the compromise extends beyond the vulnerable FMC component to the entire network infrastructure it manages.
Confidentiality (High): An attacker executing code as root on the FMC appliance gains access to all managed firewall policies, VPN configurations, network topology data, stored credentials, and security event logs. This represents a complete exposure of the organization's network security posture.
Integrity (High): With root access to the FMC, an attacker can modify firewall rules to permit malicious traffic, disable intrusion prevention policies, inject backdoor rules, tamper with audit logs, and push compromised configurations to all managed Firepower devices.
Availability (High): The attacker can disable the FMC entirely, disrupt all managed firewalls and IPS sensors, or leverage the compromised management plane to cause widespread network outages. The ransomware association confirms that threat actors are weaponizing this vulnerability for destructive operations.
The Changed scope is particularly concerning because the FMC is a centralized management platform controlling potentially hundreds of Firepower Threat Defense (FTD) devices. Compromising the FMC effectively compromises the entire perimeter security infrastructure.
Exploit Maturity
CVE-2026-20131 demonstrates very high exploit maturity with confirmed active exploitation in the wild. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on March 19, 2026, with an unusually short remediation deadline of March 22, 2026 (only 3 days), reflecting the extreme urgency. The vulnerability has a confirmed ransomware association, indicating that ransomware operators are actively incorporating this exploit into their toolkits.
The EPSS score of 0.58% may appear modest, but this reflects the relatively recent disclosure. Given the unauthenticated nature of the attack, the availability of mature Java deserialization tooling (such as ysoserial), and the high value of Cisco FMC as a target, exploitation is expected to escalate rapidly. The straightforward attack vector — sending a crafted serialized Java object to the web management interface without any authentication — makes weaponization accessible to a broad range of threat actors.
Organizations with internet-exposed FMC management interfaces face immediate risk and should treat remediation as an emergency priority.
Remediation
-
Apply the Cisco security patch immediately. Install the latest Cisco FMC software update that addresses CVE-2026-20131. Given the 3-day CISA remediation deadline and active ransomware exploitation, this should be treated as an emergency change with the highest priority.
-
Restrict network access to the FMC web management interface. The FMC management interface must never be exposed to the internet. Ensure it is accessible only from a dedicated management network segment. Implement firewall rules or ACLs that restrict access to authorized administrator IP addresses only.
-
Conduct forensic analysis of FMC appliances. Any FMC instance that had its management interface accessible from untrusted networks should be treated as potentially compromised. Review FMC audit logs for suspicious administrative activity, unexpected policy changes, and unauthorized user creation. Check for indicators of compromise including web shells, unauthorized cron jobs, and modified system files.
-
Audit all managed Firepower devices. If the FMC was compromised, all managed FTD devices may have received tampered configurations. Compare current firewall policies against known-good baselines and investigate any unauthorized rule changes, especially rules permitting unexpected inbound or outbound traffic.
-
Rotate all credentials stored on or accessible through the FMC. This includes FMC administrative accounts, LDAP/RADIUS integration credentials, VPN pre-shared keys, and any API tokens. Assume that all credentials accessible from a compromised FMC have been exfiltrated.
-
Deploy network monitoring for deserialization attack patterns. Implement IDS/IPS signatures to detect serialized Java objects in HTTP requests directed at the FMC management interface. Monitor for anomalous outbound connections from FMC appliances that may indicate command-and-control activity.
Technical Details
CVE-2026-20131 is an insecure deserialization vulnerability in the web management interface of Cisco Firepower Management Center. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding the maximum score of 10.0. The root cause is the acceptance and deserialization of untrusted Java byte streams by the FMC web application without any form of input validation, type filtering, or integrity checking. The FMC web interface processes incoming HTTP requests that contain serialized Java objects. An unauthenticated attacker can craft a malicious serialized Java object using known gadget chains present in the FMC application's classpath. When the server deserializes this object, the gadget chain executes, granting the attacker arbitrary code execution. Because the FMC web service process runs with root privileges, the attacker immediately obtains full root-level access to the appliance. The Changed scope (S:C) reflects the fact that the FMC is a centralized management platform — compromising it directly impacts all managed Firepower Threat Defense devices, intrusion prevention systems, and the organization's entire network security policy enforcement infrastructure.
Frequently Asked Questions
Is CVE-2026-20131 being actively exploited?
Yes. CISA added CVE-2026-20131 to the Known Exploited Vulnerabilities catalog on March 19, 2026, with a remediation deadline of March 22, 2026. The vulnerability has a confirmed ransomware association, indicating active use by ransomware operators.
What products are affected by CVE-2026-20131?
Cisco Firepower Management Center (FMC) is affected. All versions with the vulnerable web management interface are at risk. Consult the Cisco security advisory for specific version details and patch availability.
How do I fix CVE-2026-20131?
Apply the latest Cisco FMC software update immediately. As an immediate mitigation, restrict network access to the FMC web management interface to trusted management networks only. The management interface should never be exposed to the internet.
How severe is CVE-2026-20131?
With a CVSS score of 10.0 (the maximum possible), unauthenticated remote code execution as root, and a confirmed ransomware association, CVE-2026-20131 is among the most critical vulnerabilities disclosed. It enables complete compromise of the FMC and all managed network security devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.