Cisco FMC Exploit: CVE-2026-20131

8 min Reading Time

For 36 days, attackers gained unauthenticated root access to Cisco Secure Firewall Management Center – before Cisco released a patch. The Interlock ransomware group actively exploited the vulnerability CVE-2026-20131 (CVSS 10.0) starting January 26, 2026. Amazon Threat Intelligence uncovered the campaign via its MadPot honeypot network. There is no workaround. If you haven’t patched, you’re vulnerable.

TL;DR

• CVSS 10.0 – Maximum Severity: CVE-2026-20131 enables unauthenticated remote code execution as root on Cisco FMC (NVD, March 2026).
• 36-Day Zero-Day: First exploitation observed January 26, 2026 – Cisco’s patch arrived only on March 4, 2026 (Amazon Threat Intelligence).
• No Workarounds: Cisco confirms: no temporary mitigations exist. The only fix is upgrading to version 7.4.2.1 or later.
• CISA KEV Listing: The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities Catalog on March 19, 2026.
• Interlock in Focus: Active since September 2024, this ransomware group specializes in double extortion – and frames ransom demands around GDPR compliance to pressure European victims.

What Happened: A 36-Day Zero-Day

On January 26, 2026, Amazon’s MadPot honeypot network detected the first attacks targeting Cisco Secure Firewall Management Center (FMC). Attackers exploited a previously unknown flaw in the web management interface: CVE-2026-20131, rated at the maximum CVSS score of 10.0. The exploit requires no authentication, no user interaction – and grants full root control over the compromised system.

Cisco didn’t release the patch until March 4, 2026 – 36 days after active exploitation began. On March 18, Cisco updated its advisory to officially confirm real-world exploitation. The next day, CISA added the flaw to its Known Exploited Vulnerabilities Catalog and set a March 22 deadline for federal agencies to apply the fix. There is no workaround – patching is mandatory.

Affected versions include FMC 7.0.5 through 7.4.1.1, plus releases from the 7.6.x, 7.7.x, and 10.0.0 branches. The fixed version for the 7.4.x line is 7.4.2.1. Cisco issued patches for all affected branches in its security advisory. The timeline below underscores the urgency:

The Vulnerability: Insecure Java Deserialization

CVE-2026-20131 stems from insecure deserialization of untrusted data (CWE-502). The attack vector is the FMC’s web management interface. Here’s how it unfolds:

An attacker sends a specially crafted HTTP request to the FMC web interface. The request body contains a serialized Java object with malicious bytecode. The FMC deserializes the object without sufficient validation – and executes the embedded code with root privileges. To confirm success, the compromised system then sends an HTTP PUT request to a server controlled by the attacker. Afterward, it downloads and runs an ELF binary that fetches additional Interlock tools.

In short: one HTTP request is enough to seize complete control over the firewall management system. From there, the attacker gains access to configurations for every managed firewall, the network topology – and potentially the entire corporate network. No prior knowledge of the target is required: no credentials, no session tokens, no interaction whatsoever.

The FMC’s role in network architecture makes this especially dangerous. It serves as the central configuration hub for all connected Cisco firewalls. Whoever controls the FMC controls the organization’s entire perimeter security. Policy changes, rule updates, and access lists can be pushed across all managed devices from a single point. A compromised FMC isn’t an isolated incident – it’s a network-wide breach.

Besides CVE-2026-20131, Cisco also addressed CVE-2026-20079 in the same advisory – also rated CVSS 10.0. Both flaws were fixed with identical patches. If either CVE applies to your environment, treat both as critical.

Who’s Behind It: Interlock in Focus

The Interlock ransomware group has been active since September 2024 and employs a double-extortion strategy: exfiltrating data before encryption. Its ransom notes explicitly cite data protection laws – a GDPR framing tactic designed to heighten pressure on European victims. Negotiations occur via a TOR-based portal, with unique login credentials provided per victim.

Confirmed Interlock targets include U.S. dialysis provider DaVita, Kettering Health hospital network, Texas Tech University, and the city of Saint Paul, Minnesota. In the UK, the group deployed the NodeSnake RAT against multiple universities. Timezone analysis of operator activity points to UTC+3 – suggesting origins in Eastern Europe or Russia. Interlock operates with professional discipline: dedicated infrastructure, an in-house development team, and a clear focus on critical sectors across industrialized nations. Its blend of double extortion and GDPR framing makes it a particularly acute threat to European enterprises.

Interlock relies on a broad arsenal: PowerShell scripts for network mapping and reconnaissance, custom JavaScript- and Java-based RATs, abused ConnectWise ScreenConnect instances for persistence, fileless webshells for anti-forensics, and systematic log deletion post-compromise. The group also uses a proxy-relay infrastructure to obscure attack origins – and deploys Volatility and Certify for memory analysis and Active Directory enumeration.

Multiple analysts report that parts of Interlock’s malware were developed using generative AI tools – a trend that further lowers the barrier to creating tailored attack tooling. Interlock primarily targets sectors under high financial pressure: healthcare, education, public services, and manufacturing – all heavily represented across DACH countries.

What Amazon Uncovered

Amazon Threat Intelligence discovered the campaign via its MadPot system – a global honeypot network monitoring attacker infrastructure and command-and-control traffic. An operational security misstep by Interlock operators exposed the group’s full toolkit: reconnaissance scripts, custom RATs, evasion mechanisms, and the proxy-relay infrastructure used to mask attack origins.

Amazon coordinated disclosure with Cisco and published a detailed blog post on March 20, 2026, listing Indicators of Compromise (IoCs) and defensive recommendations. This blog remains the most comprehensive publicly available source for concrete IoCs – including file hashes, IP addresses, and domains tied to the attacker infrastructure. Security teams should immediately ingest these IoCs into detection systems and retroactively scan logs dating back to late January. Absence of matches does not guarantee safety: Interlock actively deletes logs and uses fileless techniques to evade signature-based detection.

For DACH organizations: Interlock malware samples have been submitted from Germany, though public sources don’t clarify whether those submissions relate specifically to the FMC exploit or earlier Interlock activity. As of publication, the German Federal Office for Information Security (BSI) has not issued its own advisory for CVE-2026-20131 – an omission notable given the widespread deployment of Cisco FMC across German enterprise networks.

This absence shouldn’t be mistaken for reassurance. CISA has already listed the vulnerability in its KEV Catalog and imposed a patch deadline on U.S. federal agencies. Organizations falling under NIS-2 must report any confirmed FMC compromise to the BSI within 24 hours – and submit a detailed follow-up within 72 hours. Given the 36-day window since initial exploitation, logs should be reviewed retroactively to January 26, 2026.

What to Do Now

Follow these eight steps in order. Prioritize patching first – and run forensic checks in parallel.

1. Confirm exposure. Which FMC versions are in use? Affected versions include 7.0.5 through 7.4.1.1, plus 7.6.x, 7.7.x, and 10.0.0. The full version table appears in the Cisco Advisory. Check your version via the FMC web interface under Help > About.

2. Apply the patch. Upgrade to version 7.4.2.1 or higher. With no workaround available, this is the sole effective mitigation. Cisco has released patches for all affected version branches.

3. Isolate the FMC interface. Until patched: restrict the FMC web management interface to a dedicated out-of-band management network. Block internet exposure entirely. Limit access strictly to authorized admin workstations.

4. Review logs. Hunt for anomalous HTTP requests to the FMC web interface – especially Java deserialization errors in application logs and unauthenticated traffic on management ports. HTTP PUT requests to external servers strongly indicate successful compromise.

5. Deploy IoCs. Load the full Indicator-of-Compromise list from the AWS Security Blog into SIEM and EDR systems. Search retroactively from January 26, 2026. Pay particular attention to HTTP PUT requests to unknown external servers – the confirmed exfiltration mechanism.

6. Review privileged access. If an FMC was compromised, attackers held root-level control over firewall management. All firewall configurations, credentials, and certificates managed through that FMC must be treated as potentially compromised. Mandatory actions include password rotation and full certificate renewal.

7. Activate your incident response plan. Any confirmed or suspected FMC compromise qualifies as a Severity-1 incident. The attacker likely had access to your entire firewall infrastructure. That means: audit all managed firewall rules for unauthorized changes, verify backup configuration integrity, and validate network segmentation. If you lack an incident response plan, close that gap now.

8. Verify Cisco Security Cloud Control status. Reports suggest the cloud-based Cisco Security Cloud Control (SCC) may also be vulnerable. If you use SCC, contact Cisco support directly to confirm patch status.

Conclusion

CVE-2026-20131 is the most severe Cisco exploit in recent months. Maximum CVSS score, unauthenticated root access, 36 days of active exploitation before patching – and no workarounds. It’s the worst combination a security advisory could deliver.

If you operate Cisco FMC and haven’t patched yet, you’re accepting a risk that’s indefensible – technically, and to leadership who face personal liability under NIS-2. Interlock has proven it can exploit this flaw professionally and at scale. The convergence of Java deserialization, root access, and the FMC’s central role in network architecture turns every unpatched instance into a network-wide security hazard. Patching isn’t optional – it’s urgent. Today.

Frequently Asked Questions

Is My Company Affected?

If you use Cisco Secure Firewall Management Center in versions 7.0.5 to 7.4.1.1, 7.6.x, 7.7.x, or 10.0.0: yes. The full version table is available in the Cisco Advisory cisco-sa-fmc-rce-NKhnULJh. Check your FMC version via the web interface under Help > About.

Is There a Workaround Until the Patch?

No. Cisco explicitly confirms: no workarounds exist. The only effective measure is updating to the patched version. As an interim step, restrict the FMC management interface to an isolated network and limit access to authorized admin workstations.

What is Interlock?

Interlock is a ransomware group active since September 2024 that performs double extortion: data is exfiltrated and encrypted. The group uses GDPR references in its ransom demands to increase pressure on European victims. Confirmed targets include healthcare providers, universities, and public institutions.

Where Do the IoCs Come From?

The most comprehensive publicly available IoC list was published by Amazon Threat Intelligence in the AWS Security Blog. Amazon discovered the campaign through its MadPot honeypot network and coordinated disclosure with Cisco. The IoCs include file hashes, IP addresses, and domains associated with the attacker infrastructure.

Do I Need to Comply with NIS-2 Reporting Requirements?

If your company falls under NIS-2 and you detect signs of compromise: yes. The initial report to the BSI must be submitted within 24 hours; a detailed report follows within 72 hours. Review logs retroactively from January 26, 2026 – an undetected FMC compromise can persist for weeks or months.

Header Image Source: Pexels / Markus Winkler (px:30965500)

About the author: Benedikt Langer

More articles by Benedikt Langer