Critical Cisco Firewall Management Center RCE Is Under Active Exploitation
Summary
Cisco CVE-2026-20131 is a critical, unauthenticated remote code execution flaw in Secure Firewall Management Center. Cisco reported active exploitation; CISA added it to KEV, and Zscaler observed exploit attempts using a public proof of concept.
Key points
- CVE-2026-20131 has a CVSS score of 10 and affects Cisco Secure Firewall Management Center Software.
- The flaw stems from insecure Java deserialization through the web management interface and can let unauthenticated remote attackers execute code and gain root privileges.
- Cisco warned of active exploitation on March 18, 2026; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the following day.
- Zscaler reported seeing exploit activity from March 6, 2026, targeting organizations in the U.S. technology and software sectors with public proof-of-concept payloads.
- Compromise of FMC could enable attackers to alter firewall rules, suppress alerts, or use the system to move deeper into a network.
- The article does not provide patch or affected-version details; it describes Zscaler detection coverage for Java serialization and deserialization exploit activity.
Article Details
- Vulnerability Types
- Insecure deserialization
- Remote code execution
- Severity
- Critical; CVSS score 10
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- unknown
MITRE ATT&CK
CVE
Vendors
Products
Cisco Secure Firewall Management Center (FMC) Softwarea critical remote code execution (RCE) vulnerability, CVE-2026-20131, impacting Cisco Secure Firewall Management Center (FMC) Software. The vulnerability was first disclosed by Cisco on March 4, 2026. TheZscaler DeceptionOrganizations can leverage Zscaler Deception to deploy a Cisco FMC decoy to capture any exploit activity targeting their environment. Customers leveraging Zscaler Deception technology gained fast, high-fidelityZscaler Private Access AppProtectionZscaler Private Access AppProtection
Tools
Countries
Industries
Softwareexecution (RCE) vulnerability, CVE-2026-20131, impacting Cisco Secure Firewall Management Center (FMC) Software. The vulnerability was first disclosed by Cisco on March 4, 2026. The vulnerability carries a CVSS scoreTechnologyof CVE-2026-20131 exploit activity starting March 06, 2026, targeting major organizations within the Technology and Software sectors in the United States. The exploit attempts originated from multiple IP addresses