DaystoPatch

CiscoExploited incident

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

CVE-2026-20131Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 19 Mar 2026

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 21 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
21d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-fmc-rce-NKhnULJh, v1.0 (Wayback snapshot 2026-03-04)CuratedQuote verified

    A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

    First public signal: v1.0 (First Published 2026 March 4 16:00 GMT), which said Cisco was not aware of malicious use. Exploitation that had begun earlier was only reported publicly on 2026-03-18 (see the next candidates).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:58316b1c2f2ec8c9…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CVE.org record CVE-2026-20131ClaimedQuote verified4 Mar 2026, 17:17 UTC

    A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:43cef3194c651e8a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Mar 2026, 18:07 UTC

    Second is CVE-2026-20131: remote code execution in the same product by way of, aww yiss, Java deserialization.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    AWS Security Blog (CJ Moses, 18 MAR 2026)CuratedQuote verified18 Mar 2026

    our research found that Interlock was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026.

    First public report of in-the-wild exploitation, with exploitation dated back to 2026-01-26, i.e. before any fix.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:65825dedbd055d66…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco CSAF for cisco-sa-fmc-rce-NKhnULJh, revision 1.1.0CuratedQuote verified18 Mar 2026, 16:05 UTC

    Updated with information about becoming aware of exploitation.

    CSAF revision 1.1.0 is dated 2026-03-18T16:05:27+00:00; the advisory now reads 'In March 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:df6ee6f16c218ee7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-20131)ClaimedQuote verified19 Mar 2026

    Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

    Added to CISA's KEV catalog on 2026-03-19.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet21 Mar 2026, 22:30 UTC

    📢 Interlock Ransomware exploite un zero-day Cisco FMC (CVE-2026-20131) 36 jours avant divulgation 📝 *Amazon Threat Intelligence a dé... 📖 cyberveille : https:// cyberveille.ch/posts/2026-03-2 1-interlock-ransomware-exploite-un-ze

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco PSIRT advisory cisco-sa-fmc-rce-NKhnULJhCuratedQuote verified

    First Published: 2026 March 4 16:00 GMT

    Part of the March 2026 semiannual Secure Firewall bundled publication. CSAF 1.0.0 is dated 2026-03-04T16:08:05+00:00.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8b949fff778d7a0c…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-fmc-rce-NKhnULJh, v1.0 (Wayback snapshot 2026-03-04)CuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    The advisory gives no per-release table; fixed FMC releases are only available through the Cisco Software Checker.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:58316b1c2f2ec8c9…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +21d

    Cisco CSAF for cisco-sa-fmc-rce-NKhnULJh, revision 1.2.0CuratedQuote verified

    Updated the note in the Vulnerable Products section to reflect that a hot fix is available for Cisco SCC Firewall Management.

    CSAF revision 1.2.0 is dated 2026-03-25T14:21:24+00:00. v1.0 and v1.1 (snapshots 2026-03-04 and 2026-03-22) only said SCC 'is upgraded by Cisco as part of maintenance. There is no user action required.'; the current page says 'The fix for this vulnerability has been deployed to Cisco SCC Firewall Management environments.' So the SaaS product is documented as fixed only from 2026-03-25. Whether every on-premises FMC train had a fixed release on 2026-03-04 cannot be checked from the advisory (Software Checker only).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:df6ee6f16c218ee7…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-fmc-rce-NKhnULJh

    Recorded in the revision history

    Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 15 Mar 2026, 04:31 UTC: archived copyLater version captured 22 Mar 2026, 05:55 UTC: archived copyRecovered from archived copiesSnapshots 17618cffe5… and 6f7e26c37b…Incident page

Send this to your boss

Cisco FMC flaw exploited by Interlock ransomware before fix; patch since Mar 4

A maximum-severity flaw in Cisco Secure Firewall Management Center was exploited by the Interlock ransomware group for weeks before Cisco disclosed and fixed it on 4 March 2026.

In plain words

Cisco's Firewall Management Center, the console that controls our Cisco firewalls, had a flaw that let an outsider take full control without a password. A ransomware group was using it for about five weeks before Cisco published a fix on 4 March 2026. If we run this console ourselves, it must be upgraded to a fixed version and kept off the internet, and we should check it for signs of intrusion. Cisco's cloud-hosted version has been fixed by Cisco.

What happened and who is affected

What happened

On 4 March 2026 Cisco disclosed and released fixes for CVE-2026-20131, an insecure deserialization flaw in the web management interface of Cisco Secure Firewall Management Center (FMC) that lets an unauthenticated attacker run code as root, scored 10.0. On 18 March Amazon's threat intelligence team reported that the Interlock ransomware group had been exploiting it since 26 January 2026, and Cisco updated its advisory the same day to say it was aware of attempted exploitation. CISA added it to the Known Exploited Vulnerabilities catalog on 19 March, noting known ransomware use. Cisco documented the fix for its cloud-delivered SCC Firewall Management on 25 March.

Who is affected

On-premises Cisco Secure Firewall Management Center (FMC) Software on releases without the March 2026 fix (use the Cisco Software Checker for your release), and Cisco Security Cloud Control (SCC) Firewall Management, which Cisco has patched. Cisco ASA and FTD software are not affected.

CVE-2026-20131. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2026-20131/

Affected products

  • Cisco Secure Firewall Management Center (FMC) Software
  • Cisco Security Cloud Control (SCC) Firewall Management
How we built this timeline

exploited before a fix=true under R4: Amazon reports in-the-wild exploitation beginning 26 Jan 2026, 36 days before the 4 Mar 2026 fix (made public on 18 Mar 2026). Same March 2026 bundled publication as cisco-cve-2026-20079 (separate advisory, separate exploitation timeline).

KEV lists known ransomware use (Interlock).

Related

Cisco report card