CVE-2026-20131: 
Cisco Secure Firewall Management Center vulnerability analysis and mitigation

CVE-2026-20131 is a critical remote code execution vulnerability in Cisco Secure Firewall Management Center (FMC) Software caused by insecure deserialization of user-supplied Java byte streams. An unauthenticated, remote attacker can exploit this flaw by sending a crafted serialized Java object to the FMC web-based management interface, resulting in arbitrary code execution with root privileges. The vulnerability affects Cisco Secure FMC Software across a wide range of versions (6.4.x through 7.7.x) as well as Cisco Security Cloud Control (SCC) Firewall Management. It was publicly disclosed on March 4, 2026, and carries a CVSS v3.1 base score of 10.0 (Critical) (Cisco Advisory, CISA KEV).

The root cause is CWE-502 (Deserialization of Untrusted Data): the FMC web-based management interface deserializes attacker-controlled Java byte streams without adequate validation or sanitization. An attacker sends a crafted HTTP request containing a malicious serialized Java object to the management interface endpoint; upon deserialization, the payload executes arbitrary Java code in the context of the FMC process, which runs as root. No authentication, user interaction, or special configuration is required, and the scope is changed (S:C), meaning a successful exploit can impact resources beyond the vulnerable component itself. The attack surface is reduced if the FMC management interface is not exposed to the public internet, but the vulnerability is exploitable from any network-reachable position. Cisco Bug ID CSCwt14636 tracks this issue, and Snort rules 66082 and 66083 are available for detection (Cisco Advisory, Zscaler Research).

Successful exploitation grants an unauthenticated attacker full root-level control over the Cisco FMC appliance, enabling complete confidentiality, integrity, and availability compromise. Because FMC centrally manages firewall policies and network security infrastructure, an attacker with root access can manipulate firewall rules, exfiltrate sensitive network configuration data, pivot laterally to managed Firepower devices, and deploy ransomware or other malware across the enterprise. The Interlock ransomware group leveraged this vulnerability to deploy custom remote access trojans, conduct reconnaissance, exfiltrate data, and ultimately encrypt victim environments, demonstrating the full lateral movement potential of this flaw (AWS Security Blog, Cisco Advisory).

1. Reconnaissance: Identify internet-facing Cisco Secure FMC instances using tools like Shodan or Censys, targeting the web-based management interface (typically HTTPS on port 443). Confirm the version is within the vulnerable range (6.4.x–7.7.x).
2. Craft malicious payload: Construct a serialized Java object containing a malicious payload (e.g., a command execution gadget chain compatible with the FMC's Java runtime environment). Interlock embedded URLs in request bodies to deliver configuration data and confirm exploitation via an HTTP PUT callback.
3. Send exploit request: Transmit an HTTP POST request containing the crafted serialized Java byte stream to the FMC management interface endpoint. No authentication is required. Observed User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0.
4. Confirm code execution: The FMC deserializes the object and executes the embedded payload as root. Interlock used a connectivity verification tool (TCP beacon on port 45588) to confirm successful exploitation.
5. Deploy implants: Download and execute a malicious ELF binary or Java class file (memory-resident webshell) from an attacker-controlled staging server. Interlock also deployed a JavaScript RAT and Java RAT for persistent C2 over WebSocket with RC4 encryption.
6. Establish persistence and lateral movement: Use deployed tools (ConnectWise ScreenConnect, Certify for AD CS abuse, PowerShell reconnaissance scripts) to enumerate the environment, harvest credentials, and spread to additional systems.
7. Execute ransomware: After completing reconnaissance and data exfiltration, deploy the Interlock ransomware encryptor across the victim environment (AWS Security Blog, Cisco Advisory).

• Network — Exploit Source IPs: 206.251.239[.]164 (active Jan 2026), 199.217.98[.]153 (active Mar 2026), 89.46.237[.]33 (active Mar 2026)
• Network — C2 IPs: 144.172.94[.]59, 199.217.99[.]121, 188.245.41[.]78, 144.172.110[.]106, 95.217.22[.]175
• Network — Staging Host: 37.27.244[.]222
• Network — C2 Domains: browser-updater[.]com, browser-updater[.]live, os-update-server[.]com/.org/.live/.top
• Network — Exploit Support Domains: cherryberry[.]click, ms-server-default[.]com, initialize-configs[.]com, ms-global.first-update-server[.]com, ms-sql-auth[.]com, kolonialeru[.]com, sclair.it[.]com
• Network — TOR Portal: hxxp://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid[.]onion/chat.php
• Network — TLS Fingerprints: JA3 b885946e72ad51dca6c70abc2f773506 and f80d3d09f61892c5846c854dd84ac403; JA4 t13i1811h1_85036bcba153_b26ce05bbdd6 and t13i4311h1_c7886603b240_b26ce05bbdd6
• Network — Unusual Ports: TCP connections to port 45588 from FMC host (connectivity beacon)
• Network — HTTP: Exploit HTTP User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 in requests to FMC management interface
• File System — Hashes: Certify offensive tool SHA-256 d1caa376cb45b6a1eb3a45c5633c5ef75f7466b8601ed72c8022a8b3f6c1f3be; Screen locker SHA-256 6c8efbcef3af80a574cb2aa2224c145bb2e37c2f3d3f091571708288ceb22d5f
• File System: Unexpected ELF binaries or Java class files on FMC; HAProxy installations with log-deletion cron jobs (truncate *.log every 5 minutes under /var/log)
• Logs: HTTP POST requests to FMC management interface with serialized Java object bodies; Java deserialization errors or unexpected Java class loading in FMC application logs
• Process: Unusual child processes spawned by FMC Java process; PowerShell scripts staging data to network shares with hostname-based directory structures (e.g., \JK-DC2\Temp); unexpected ScreenConnect or Volatility processes (AWS Security Blog)

Cisco has released patched software versions for all affected FMC release trains; organizations should use the Cisco Software Checker to identify the appropriate fixed release for their deployment. Cisco SCC Firewall Management (SaaS) was patched automatically by Cisco and requires no customer action. There are no workarounds that fully address this vulnerability. As a risk-reduction measure, restrict network access to the FMC web-based management interface to trusted internal networks only and avoid exposing it to the public internet. CISA issued a directive requiring federal agencies to patch by March 22, 2026. Organizations should also review the Interlock IOCs provided by Amazon and audit FMC logs for signs of prior compromise (Cisco Advisory, CISA KEV, BleepingComputer).

Amazon's CISO CJ Moses published a detailed threat intelligence blog on March 18, 2026, revealing that Amazon MadPot honeypots detected Interlock exploiting this vulnerability 36 days before public disclosure, and shared the full attack chain and IOCs with the community (AWS Security Blog). The Register, BleepingComputer, The Hacker News, and CyberScoop all covered the story prominently, with The Register noting Amazon's security boss publicly calling out the pre-disclosure abuse. Security Affairs reported that Interlock had been exploiting the flaw for 36 days before the patch, and CISA's rapid KEV addition (within 15 days of disclosure) with a 3-day federal remediation deadline underscored the severity. Zscaler published a technical deep-dive on the deserialization mechanism, and FortiGuard issued an Outbreak Alert for Interlock ransomware. Community sentiment on Reddit and Mastodon reflected alarm at the extended zero-day window and the critical CVSS 10.0 score, with sysadmins urgently discussing patching timelines (The Register, Security Affairs).