Threat Intelligence / CVE / CVE-2026-20131

CVE-2026-20131 — Cisco Secure Firewall Management Center

CISA KEVRansomware

CVSS v3.1 10 (CRITICAL) · EPSS 0.7% (higher than 73.9% of all scored CVEs) · Priority 10/10 · Published 2026-03-04

As of 2026-04-08, CVE-2026-20131 is a CRITICAL-severity vulnerability in Cisco Secure Firewall Management Center, CVSS v3.1 10, EPSS 0.7% (73.9th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-03-19), with a US federal remediation deadline of 2026-03-22, and CISA links it to known ransomware campaigns. Threadlinqs Intelligence links 3 tracked threat campaigns to CVE-2026-20131, most recently “Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto”.

Last updated: 2026-04-08

What is CVE-2026-20131?

Maximum-severity (CVSS 10.0) unauthenticated remote code execution vulnerability in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) caused by insecure deserialization of user-supplied Java byte streams (CWE-502). The management interface accepts and deserializes Java byte streams (magic bytes 0xAC ED 00 05) from untrusted sources without implementing proper input validation, type checking, or object filtering. Attackers can construct malicious object graphs (gadget chains) leveraging existing classpath libraries to achieve arbitrary Java code execution with root privileges. Tracked as Cisco Bug ID CSCwt14636, advisory cisco-sa-fmc-rce-NKhnULJh. Actively exploited as a zero-day by the Interlock ransomware group since January 26, 2026 — 36 days before Cisco disclosure on March 4, 2026. CISA added to KEV catalog March 19, 2026 with ransomware campaign flag. Attack chain: crafted HTTP requests with serialized Java objects, ELF binary payload delivery, persistent memory-resident Java backdoor (no files on disk), post-exploitation via PowerShell recon, custom JS/Java RATs with SOCKS5 proxy, and ConnectWise ScreenConnect for persistence. No workarounds available.

The record classifies CVE-2026-20131 under weakness class CWE-502. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 8 affected-product entries are recorded, across 2 vendors, listed below. The identifier was first published 192 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 10 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (FIRST): 0.7% probability of exploitation in the next 30 days, higher than 73.9% of all scored CVEs
CISA KEV: Listed since 2026-03-19, federal remediation deadline 2026-03-22 — used in known ransomware campaigns
Threadlinqs priority: 10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum
Published: 2026-03-04, last modified 2026-04-08

Is CVE-2026-20131 being exploited?

CISA added CVE-2026-20131 to the Known Exploited Vulnerabilities catalog on 2026-03-19, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-03-22 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. It currently carries a trending score of 33 in the Threadlinqs vulnerability feed.

Affected products and versions

Cisco: Secure Firewall Management Center 6.4.0.13, Secure Firewall Management Center 7.0.0, Secure Firewall Management Center 7.2.0, Secure Firewall Management Center 7.4.0, Secure Firewall Management Center 7.6.0, Secure Firewall Management Center 7.7.0, Secure Firewall Management Center 10.0.0
(vendor unspecified): Cisco Security Cloud Control (SCC) Firewall Management

How to fix CVE-2026-20131

The record marks a vendor fix as available for CVE-2026-20131. Vendor advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh. Because CVE-2026-20131 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-03-22. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2026-20131

3 tracked threats in the Threadlinqs corpus reference CVE-2026-20131, either in the campaign’s CVE list or as an indicator on the campaign record.

Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto — HIGH · 2026-09-03
CVE-2026-20316: Cisco Secure Firewall Management Center Hard-coded Password Vulnerability Added to CISA KEV — CRITICAL · 2026-07-29
Cisco Secure Firewall Management Center Insecure Java Deserialization RCE (CVE-2026-20131) — Interlock Ransomware Zero-Day Exploitation — CRITICAL · 2026-03-21

Sources

Seeded from threat-derived and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2026-20131 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence