{"id":"CVE-2026-20131","published":"2026-03-04T18:16:27Z","modified":"2026-06-17T10:17:10Z","title":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management…","vendor":"Cisco","product":"Secure Firewall Management Center (FMC)","tier":"core","eol":null,"description":{"text":"A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.","provenance":"source","from":"NVD"},"summary":{"text":"Cisco Secure Firewall Management Center (FMC) Software has an insecure deserialization flaw in its web-based management interface, caused by unsafe handling of user-supplied Java byte streams. An unauthenticated attacker with remote network access can exploit it without user interaction by sending a crafted serialized Java object to that interface, allowing arbitrary Java code execution as root on the affected device, and the attack surface is reduced if the FMC management interface lacks public internet access.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:01:57Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.44431,"percentile":0.98762,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-03-19","dueDate":"2026-03-22","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-03-18","exploitedFirstSeen":"2026-03-18","ransomware":true,"evidence":[{"url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/","date":"2026-03-18"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh","date":"2026-03-18"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/interlock-ransomware","date":"2026-03-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-03-19"},{"url":"https://www.zscaler.com/blogs/security-research/critical-remote-code-execution-vulnerability-cisco-secure-firewall","date":"2026-03-23"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks","date":"2026-03-31"},{"url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligence-report-30-mar-2026-d811e5508cba","date":"2026-04-03"},{"url":"https://www.recordedfuture.com/blog/march-2026-cve-landscape","date":"2026-04-13"},{"url":"https://cyble.com/blog/monthly-threat-landscape-march-2026/","date":"2026-04-20"},{"url":"https://thecyberexpress.com/march-2026-threat-landscape/","date":"2026-04-22"}],"evidenceTotal":18,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability","url":"https://otx.alienvault.com/pulse/6ae28386158c5f73da5c681b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh","tags":["Vendor Advisory"]},{"url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/","tags":["Technical Description"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of management interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an unauthenticated, remote attacker to execute arbitrary Java code","start":112,"end":190}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution on device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary Java code as root","start":163,"end":198}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-9444","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9444","exploited":true,"exploitedSince":"2026-03-19","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":1,"earliest":"2026-03-11","earliestUrl":"https://github.com/sak110/CVE-2026-20131","repos":[{"name":"sak110/CVE-2026-20131","url":"https://github.com/sak110/CVE-2026-20131","stars":3,"created":"2026-03-11"},{"name":"Hassan-Pouladi/Cisco-FMC-honeypot","url":"https://github.com/Hassan-Pouladi/Cisco-FMC-honeypot","stars":2,"created":"2026-04-07"},{"name":"0xBlackash/CVE-2026-20131","url":"https://github.com/0xBlackash/CVE-2026-20131","stars":0,"created":"2026-05-10"},{"name":"Jwa7470/CVE-2026-20131-Post-Incident-Written-Report","url":"https://github.com/Jwa7470/CVE-2026-20131-Post-Incident-Written-Report","stars":0,"created":"2026-08-28"},{"name":"basesixtythree/B63-POC-CVE-2026-20131","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-20131","stars":0,"created":"2026-10-26"}]},"first":{"date":"2026-03-11","source":"PoC-in-GitHub","url":"https://github.com/sak110/CVE-2026-20131"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-03-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20131","provenance":"source"},{"date":"2026-03-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sak110/CVE-2026-20131","provenance":"source"},{"date":"2026-03-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/","provenance":"source"},{"date":"2026-03-19","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-03-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9444","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"PoC-in-GitHub","daysToKev":15},"priority":{"score":84.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 227 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.75,"detail":"percentile 0.9876"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}