# Interlock Ransomware Exploits Cisco FMC Zero-Day (CVE-2026-20265) Amid March 2026 CVE Surge

> Interlock ransomware affiliates are actively exploiting CVE-2026-20265, an unauthenticated pre-auth RCE in Cisco Secure Firewall Management Center (FMC), to breach enterprise perimeters and deploy double-extortion ransomware. Recorded Future Insikt Group and CISA confirm in-the-wild exploitation, with the flaw chained to AdaptixC2 beaconing, lateral movement via SMB/WinRM, and Interlock encryptor deployment. CVE-2026-20265 is one of 31 high-impact CVEs flagged for immediate remediation in a 139% month-over-month vulnerability surge.

- **Published:** 2026-04-13T12:00:00Z
- **Last reviewed:** 2026-04-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0356
- **ID:** TL-2026-0356
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Interlock Ransomware Group (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20265

## Description

On 2026-04-08 Cisco PSIRT published advisory cisco-sa-fmc-rce-2026 disclosing CVE-2026-20265, a critical unauthenticated remote code execution vulnerability in the Cisco Secure Firewall Management Center (FMC) web management interface. The flaw resides in the HTTPS administration endpoint and stems from improper input validation inside the CertEnrollServlet Java servlet, where attacker-controlled XML parameters are deserialized without validation, yielding arbitrary OS command execution as the tomcat user (rooted to the Linux shell via a stacked sudo configuration present by default). CVSS 3.1 scoring is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). FMC versions 7.2.0 through 7.6.2 are affected; Cisco released fixed builds 7.2.9.1, 7.4.2.3, and 7.6.2.1 on the same day.

Recorded Future Insikt Group (RFI) independently confirmed active exploitation in a 2026-04-10 report, tying the campaign to the Interlock ransomware group. Interlock, first observed in mid-2024, has rebuilt its affiliate infrastructure on AdaptixC2 — a Rust-based open-source C2 framework released in late 2025 — and is using FMC compromise as an initial access vector into enterprise networks in healthcare, manufacturing, and professional services verticals in North America and Europe. Post-exploitation, operators drop a staged beacon via curl, establish persistence by modifying /etc/cron.d/ entries on the FMC appliance, and pivot from the management network into downstream segments by abusing legitimate FMC push-policy workflows and harvested SSH keys.

Once inside the enterprise network, affiliates perform rapid Active Directory reconnaissance with SharpHound/BloodHound, dump LSASS via comsvcs.dll minidump, and escalate using DCSync from compromised service accounts. Lateral movement is achieved with legitimate Windows administration tools (PsExec, WinRM) and a renamed copy of AdaptixC2's implant. Data staging occurs on internal file shares, with exfiltration over Rclone to MEGA and a dedicated Interlock leak-site drop server. Interlock then deploys its ChaCha20-based encryptor across domain-joined Windows hosts via GPO and scheduled tasks, appending the .interlock extension and dropping !__README__!.txt ransom notes demanding payment in Monero.

CISA added CVE-2026-20265 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-10 with a federal remediation deadline of 2026-04-24 and issued joint advisory AA26-100A co-sealed with the FBI and NSA. RFI assesses with high confidence that at least nine victim organizations have been compromised since 2026-03-22, including a regional US hospital network and a European automotive Tier-1 supplier. The Interlock campaign is assessed as financially motivated, though RFI notes tooling overlap with prior activity attributed to the Russian-speaking criminal ecosystem and occasional crossover with nation-state aligned access brokers.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Cisco Security Advisory cisco-sa-fmc-rce-2026](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-2026)
- [CISA Advisory AA26-100A: Interlock Ransomware Exploiting Cisco FMC Zero-Day](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-100a)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Recorded Future Insikt Group: March 2026 Vulnerability Landscape](https://www.recordedfuture.com/research/march-2026-vulnerability-landscape-interlock-fmc-zero-day)
- [NVD CVE-2026-20265](https://nvd.nist.gov/vuln/detail/CVE-2026-20265)
- [FBI Flash Alert: Interlock Ransomware TTPs](https://www.ic3.gov/Media/News/2026/Interlock-Flash.pdf)
- [AdaptixC2 Framework Analysis](https://github.com/Adaptix-Framework/AdaptixC2)
- [SOCRadar: Interlock Ransomware Group Profile](https://socradar.io/dark-web-profile-interlock-ransomware)
- [BleepingComputer: Cisco FMC Zero-Day Exploited by Interlock](https://www.bleepingcomputer.com/news/security/cisco-fmc-zero-day-interlock-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0356