# Cisco Secure Firewall Management Center Insecure Java Deserialization RCE (CVE-2026-20131) — Interlock Ransomware Zero-Day Exploitation

> Critical unauthenticated remote code execution vulnerability in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) caused by insecure deserialization of user-supplied Java byte streams (CWE-502). CVSS 10.0. Actively exploited as a zero-day by the Interlock ransomware group since January 26, 2026 — 36 days before Cisco's March 4 disclosure. CISA added to KEV catalog March 19, 2026 with ransomware campaign flag.

- **Published:** 2026-03-21T12:00:00Z
- **Last reviewed:** 2026-03-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0260
- **ID:** TL-2026-0260
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Interlock Ransomware Group (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20131

## Description

CVE-2026-20131 is a maximum-severity (CVSS 10.0) vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. The flaw resides in the application's handling of serialized Java objects — the management interface accepts and deserializes Java byte streams from untrusted sources without implementing proper input validation, type checking, or object filtering.

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted serialized Java object (identified by magic bytes 0xAC ED 00 05) to the web-based management interface. The application deserializes this data back into objects without validating the source or content, instantiating classes defined in the stream. This allows attackers to construct malicious object graphs — gadget chains — leveraging existing classpath libraries (similar to ysoserial-generated payloads) to achieve arbitrary Java code execution with root privileges on the affected device.

The vulnerability is tracked as Cisco Bug ID CSCwt14636 and advisory cisco-sa-fmc-rce-NKhnULJh. No workarounds are available; patching is the only remediation.

Amazon threat intelligence teams, using their MadPot honeypot system, discovered that the Interlock ransomware group began exploiting CVE-2026-20131 as a zero-day on January 26, 2026 — a full 36 days before Cisco publicly disclosed and patched the vulnerability on March 4, 2026. An operational security failure by the Interlock group exposed a misconfigured infrastructure server, revealing their complete cybercrime toolkit organized by target victim.

The observed attack chain proceeds as follows: (1) Initial access via crafted HTTP requests containing serialized Java objects targeting a specific path on the FMC management interface; (2) The request body contains Java code execution attempts with two embedded URLs — one delivering configuration data supporting the exploit and another designed to confirm successful exploitation by causing the vulnerable target to perform an HTTP PUT request; (3) An ELF binary payload is fetched from a remote server; (4) A persistent memory-resident backdoor is installed — a Java class file that, when loaded by the JVM, intercepts HTTP requests without writing files to disk; (5) Post-exploitation tooling is deployed including PowerShell reconnaissance scripts, custom JavaScript and Java RATs with SOCKS5 proxy capability, and ConnectWise ScreenConnect for persistent remote access.

Interlock's post-exploitation toolkit includes: PowerShell scripts for Windows environment enumeration (OS details, services, installed software, Hyper-V inventory, browser artifacts from Chrome/Edge/Firefox/IE/360, network connections, RDP logs); custom JavaScript and Java remote access trojans featuring interactive shell access, bidirectional file transfer, SOCKS5 proxy capability, and self-update/self-delete mechanisms; Bash scripts configuring compromised Linux servers as HTTP reverse proxies using fail2ban and HAProxy on port 80; the Volatility Framework for memory forensics and credential extraction; and the Certify tool for Active Directory Certificate Services exploitation.

FMC sits at the center of firewall management operations — a compromised FMC becomes an attacker staging point for broader intrusion, credential harvesting, configuration tampering, and ransomware deployment across the entire managed firewall environment. The Interlock group, active since September 2024, primarily targets education, healthcare, industrial, and government sectors with disruption-driven ransom demands. Notable prior victims include DaVita, Kettering Health, and Texas Tech University. Operational analysis indicates the group operates in the UTC+3 timezone.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1014 Rootkit
- T1003 OS Credential Dumping
- T1649 Steal or Forge Authentication Certificates
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1090 Proxy
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog (March 19, 2026)](https://www.cisa.gov/news-events/alerts/2026/03/19/cisa-adds-one-known-exploited-vulnerability-catalog)
- [Cisco Security Advisory cisco-sa-fmc-rce-NKhnULJh — FMC RCE Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh)
- [Amazon Threat Intelligence: Interlock Ransomware Campaign Targeting Enterprise Firewalls](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/)
- [Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access — The Hacker News](https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html)
- [Interlock Group Exploiting Cisco FMC Flaw 36 Days Before Disclosure — Security Affairs](https://securityaffairs.com/189636/malware/interlock-group-exploiting-the-cisco-fmc-flaw-cve-2026-20131-36-days-before-disclosure.html)
- [Cisco FMC Flaw Exploited by Interlock Weeks Before Patch — Help Net Security](https://www.helpnetsecurity.com/2026/03/20/cisco-fmc-interlock-ransomware-cve-2026-20131/)
- [Cisco Patches FMC Software Vulnerabilities CVE-2026-20079 and CVE-2026-20131 — Qualys](https://threatprotect.qualys.com/2026/03/05/cisco-patches-secure-firewall-management-center-software-vulnerabilities-cve-2026-20079-cve-2026-20131/)
- [CVE-2026-20131: Unauthenticated RCE in Cisco Secure Firewall Management Center — CVE Reports](https://cvereports.com/reports/CVE-2026-20131)
- [CVE-2026-20079 and CVE-2026-20131 — Arctic Wolf](https://arcticwolf.com/resources/blog/cve-2026-20079-cve-2026-20131/)
- [CVE-2026-20131 Cisco Secure Firewall RCE Vulnerability — SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2026-20131/)
- [Interlock Ransomware Campaign Uses Cisco Firewall Exploit — TechNadu](https://www.technadu.com/interlock-ransomware-campaign-exploited-cisco-firewall-vulnerability-cve-2026-20131-weeks-before-disclosure/623700/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0260