CVE
CVE-2026-20131
- First Reported
- Mar 23, 2026
- Latest Reported
- Sep 3, 2026
CVE Enrichment
- CVSS
- 10.0 CRITICAL
- EPSS
- 43.17%
- EPSS Percentile
- 98.70%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- psirt@cisco.com
- Published
- 05-Mar-2026 01:16
- Last Modified
- 17-Jun-2026 17:17
- EPSS Date
- 2026-10-12
- CWE
- CWE-502
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:C /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2026-03-19
- Remediation Due
- 2026-03-22
- Known Ransomware Campaign Use
- Known
- Required Action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131
Affected Products / Versions
- cisco / secure_firewall_management_center
Version / affected range: 6.4.0.13
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 6.4.0.14
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 6.4.0.15
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 6.4.0.16
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 6.4.0.17
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 6.4.0.18
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.0.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.1.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.2.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.4
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.4:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.5
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.5:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.6
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.6.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.6.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.6.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.7
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.7:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.8
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.0.8.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.1.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.1.0.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.1.0.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.1.0.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.0.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.3.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.4
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.4.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.5
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.5.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.5.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.6
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.6:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.7
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.7:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.8
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.8.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.9
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.9:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.10
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.10.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.2.10.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.3.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.3.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.3.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.3.1.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.3.1.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.1.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.2.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.2.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.2.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.2.4
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.4:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.4
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.4:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.4.5
cpe:2.3:a:cisco:secure_firewall_management_center:7.4.5:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.6.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.6.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.6.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.6.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.6.2
cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.6.2.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.6.3
cpe:2.3:a:cisco:secure_firewall_management_center:7.6.3:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.6.4
cpe:2.3:a:cisco:secure_firewall_management_center:7.6.4:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.7.0
cpe:2.3:a:cisco:secure_firewall_management_center:7.7.0:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.7.10
cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.7.10.1
cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10.1:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 7.7.11
cpe:2.3:a:cisco:secure_firewall_management_center:7.7.11:*:*:*:*:*:*:* - cisco / secure_firewall_management_center
Version / affected range: 10.0.0
cpe:2.3:a:cisco:secure_firewall_management_center:10.0.0:*:*:*:*:*:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (3)
- Threat actors deploying Interlock ransomware exploited a Cisco Secure Firewall Management Center zero-day (CVE-2026-20131) to execute code as root on unpatched devices Recorded Future Reports 215 Actively Exploited CVEs and Expanding Supply-Chain Threats in H1 2026
- AWS published a report on a newly disclosed vulnerability affecting Cisco Firewall Management Center (CVE-2026-20131), with exploitation of its MadPot honeypot system detected in the wild. According to the AWS CTI Team Cymru Sees Increased Risknet Traffic Targeting Ivanti and Citrix Devices
- Cisco disclosed a critical remote code execution (RCE) vulnerability, CVE-2026-20131, impacting Cisco Secure Firewall Management Center (FMC) Software. The vulnerability was first disclosed by Cisco on March 4, 2026. Critical Cisco Firewall Management Center RCE Is Under Active Exploitation
CVE (8)
Malware (50)
People (1)
Threat Actors (14)
MITRE ATT&CK (13)
Vendors (28)
Products (68)
Tools (15)
Industries (12)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.