Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20131 10.0
Cisco · Secure Firewall Management Center (FMC) · Added 2026-03-19 · Published 2026-03-04
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityCisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
VendorCisco
ProductSecure Firewall Management Center (FMC)
Date added2026-03-19
Due date2026-03-22
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-502
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descriptions

KEV: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

NVD: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-28 07:41 UTC
Wall time45.0s
Searches5
Component defaultyes
Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-fmc-rce-NKhnULJh.html
https://github.com/sak110/CVE-2026-20131
https://github.com/p3Nt3st3r-sTAr/CVE-2026-20131-POC
https://www.zscaler.com/blogs/security-research/critical-remote-code-execution-vulnerability-cisco-secure-firewall
https://arcticwolf.com/resources/blog/cve-2026-20079-cve-2026-20131/
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20131/
https://www.sentinelone.com/vulnerability-database/cve-2026-20131/
https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/system-config.html

Hunting hypothesis agent

Hunt FMC access logs for HTTP POSTs to /invoker/JMXInvokerServlet or /dispatcher carrying Java magic bytes (\xAC\xED\x00\x05) with Content-Type application/x-java-serialized-object; HTTP 500 confirms ysoserial gadget chain fired as root.

Research details

ComponentJava ObjectInputStream deserialization in FMC web-based management interface (Apache Tomcat-based JMXInvokerServlet, EJBInvokerServlet, dispatcher, and j_spring_security_check endpoints accepting unauthenticated HTTP POST)
PreconditionsTarget must run a vulnerable version of Cisco Secure Firewall Management Center (FMC) Software (versions 6.4.0.13 through 7.7.11 and 10.0.0 are affected) or Cisco Security Cloud Control (SCC) Firewall Management. The web-based management interface (HTTPS on TCP port 443, enabled by default) must be network-reachable. No authentication is required. An attacker sends a crafted serialized Java object (identified by Java serialization magic bytes \xAC\xED\x00\x05) via HTTP POST to the FMC web interface to trigger deserialization and arbitrary code execution with root privileges. Cisco confirmed there are no workarounds - only patching resolves the vulnerability. agent
DeliveryAttacker sends HTTP POST with Content-Type 'application/x-java-serialized-object' to FMC deserialization endpoints (e.g. /invoker/JMXInvokerServlet, /invoker/EJBInvokerServlet, /dispatcher, /j_spring_security_check). The POST body contains a ysoserial-generated serialized Java gadget chain (CommonsCollections6, Spring1/2, Groovy1, etc.) starting with magic bytes \xAC\xED\x00\x05. The FMC JVM deserializes the object via readObject() without type validation, firing the gadget chain and executing arbitrary commands as root. HTTP 500 response typically confirms the payload was processed.
Public PoCyes
PoC URLs https://github.com/sak110/CVE-2026-20131
https://github.com/p3Nt3st3r-sTAr/CVE-2026-20131-POC Third-party repos; verify before use.
Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0). Public PoC exploits available on GitHub (sak110/CVE-2026-20131 with check.py detection probe and poc.py full exploit; p3Nt3st3r-sTAr/CVE-2026-20131-POC). The sak110 PoC uses ysoserial to generate gadget-chain payloads (CommonsCollections6, Spring1/2, Groovy1) and POSTs them to four FMC endpoints. A 500 or unexpected 200 on a deserialization endpoint confirms the server processed the serialized input. The detection script (check.py) sends bare Java serialization magic bytes (\xAC\xED\x00\x05) with no gadget chain — safe for production scanning. No authentication required; no user interaction. Exploitation confirmed in the wild by Interlock ransomware group (AWS threat intelligence, March 2026). Active since at least 2023 per CISA KEV. FMC management interface must be network-reachable (HTTPS/TCP 443, enabled by default).
SummaryCVE-2026-20131 is a critical (CVSS 10.0) pre-authentication Java deserialization vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC). An unauthenticated, remote attacker can achieve root-level remote code execution by sending a crafted serialized Java object via HTTP POST. Public proof-of-concept exploits are available on GitHub, and active exploitation by the Interlock ransomware group has been confirmed in the wild.

Tia coverage

First reported2026-07-29

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-vinterlock-ransomware-weaponizes-forensic-tools-for-credential-th

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub