Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-20131 Published 2026-03-04 Updated 5 months ago Vendor/s Cisco Product/s Secure Firewall Management Center (FMC) Version/s 6.4.0.13 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 10 / 10 Critical Severity Details Base score 10 Critical Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality High Integrity High Availability High Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description Critical CVSS 10.0 RCE in Cisco FMC allows unauthenticated root access via insecure deserialization. Actively exploited and listed on CISA KEV. ## Why this matters CVE-2026-20131 is a critical vulnerability with a maximum CVSS score of 10.0, indicating the highest possible risk level. It allows unauthenticated, remote attackers to execute arbitrary Java code with root privileges on Cisco Secure Firewall Management Center (FMC) devices. Because this flaw is actively exploited and listed on the CISA KEV catalog, security teams must prioritize it immediately. The vulnerability stems from insecure deserialization, a common vector for full system compromise. Organizations using FMC to manage their network security infrastructure are at significant risk, especially if the management interface is exposed to the public internet. ## CPE Cisco | Product | Version Start | Version End (excl.) | Status | | ------------------------------------ | ------------- | ------------------- | ---------- | | secure\_firewall\_management\_center | 6.4.0.13 | 6.4.0.13 | vulnerable | | secure\_firewall\_management\_center | 6.4.0.14 | 6.4.0.14 | vulnerable | | secure\_firewall\_management\_center | 6.4.0.15 | 6.4.0.15 | vulnerable | | secure\_firewall\_management\_center | 6.4.0.16 | 6.4.0.16 | vulnerable | | secure\_firewall\_management\_center | 6.4.0.17 | 6.4.0.17 | vulnerable | | secure\_firewall\_management\_center | 6.4.0.18 | 6.4.0.18 | vulnerable | | secure\_firewall\_management\_center | 7.0.0 | 7.0.0 | vulnerable | | secure\_firewall\_management\_center | 7.0.0.1 | 7.0.0.1 | vulnerable | | secure\_firewall\_management\_center | 7.0.1 | 7.0.1 | vulnerable | | secure\_firewall\_management\_center | 7.0.1.1 | 7.0.1.1 | vulnerable | | secure\_firewall\_management\_center | 7.0.2 | 7.0.2 | vulnerable | | secure\_firewall\_management\_center | 7.0.2.1 | 7.0.2.1 | vulnerable | | secure\_firewall\_management\_center | 7.0.3 | 7.0.3 | vulnerable | | secure\_firewall\_management\_center | 7.0.4 | 7.0.4 | vulnerable | | secure\_firewall\_management\_center | 7.0.5 | 7.0.5 | vulnerable | | secure\_firewall\_management\_center | 7.0.6 | 7.0.6 | vulnerable | | secure\_firewall\_management\_center | 7.0.6.1 | 7.0.6.1 | vulnerable | | secure\_firewall\_management\_center | 7.0.6.2 | 7.0.6.2 | vulnerable | | secure\_firewall\_management\_center | 7.0.6.3 | 7.0.6.3 | vulnerable | | secure\_firewall\_management\_center | 7.0.7 | 7.0.7 | vulnerable | | secure\_firewall\_management\_center | 7.0.8 | 7.0.8 | vulnerable | | secure\_firewall\_management\_center | 7.0.8.1 | 7.0.8.1 | vulnerable | | secure\_firewall\_management\_center | 7.1.0 | 7.1.0 | vulnerable | | secure\_firewall\_management\_center | 7.1.0.1 | 7.1.0.1 | vulnerable | | secure\_firewall\_management\_center | 7.1.0.2 | 7.1.0.2 | vulnerable | | secure\_firewall\_management\_center | 7.1.0.3 | 7.1.0.3 | vulnerable | | secure\_firewall\_management\_center | 7.2.0 | 7.2.0 | vulnerable | | secure\_firewall\_management\_center | 7.2.0.1 | 7.2.0.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.1 | 7.2.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.2 | 7.2.2 | vulnerable | | secure\_firewall\_management\_center | 7.2.3 | 7.2.3 | vulnerable | | secure\_firewall\_management\_center | 7.2.3.1 | 7.2.3.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.4 | 7.2.4 | vulnerable | | secure\_firewall\_management\_center | 7.2.4.1 | 7.2.4.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.5 | 7.2.5 | vulnerable | | secure\_firewall\_management\_center | 7.2.5.1 | 7.2.5.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.5.2 | 7.2.5.2 | vulnerable | | secure\_firewall\_management\_center | 7.2.6 | 7.2.6 | vulnerable | | secure\_firewall\_management\_center | 7.2.7 | 7.2.7 | vulnerable | | secure\_firewall\_management\_center | 7.2.8 | 7.2.8 | vulnerable | | secure\_firewall\_management\_center | 7.2.8.1 | 7.2.8.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.9 | 7.2.9 | vulnerable | | secure\_firewall\_management\_center | 7.2.10 | 7.2.10 | vulnerable | | secure\_firewall\_management\_center | 7.2.10.1 | 7.2.10.1 | vulnerable | | secure\_firewall\_management\_center | 7.2.10.2 | 7.2.10.2 | vulnerable | | secure\_firewall\_management\_center | 7.3.0 | 7.3.0 | vulnerable | | secure\_firewall\_management\_center | 7.3.1 | 7.3.1 | vulnerable | | secure\_firewall\_management\_center | 7.3.1.1 | 7.3.1.1 | vulnerable | | secure\_firewall\_management\_center | 7.3.1.2 | 7.3.1.2 | vulnerable | | secure\_firewall\_management\_center | 7.4.0 | 7.4.0 | vulnerable | | secure\_firewall\_management\_center | 7.4.1 | 7.4.1 | vulnerable | | secure\_firewall\_management\_center | 7.4.1.1 | 7.4.1.1 | vulnerable | | secure\_firewall\_management\_center | 7.4.2 | 7.4.2 | vulnerable | | secure\_firewall\_management\_center | 7.4.2.1 | 7.4.2.1 | vulnerable | | secure\_firewall\_management\_center | 7.4.2.2 | 7.4.2.2 | vulnerable | | secure\_firewall\_management\_center | 7.4.2.3 | 7.4.2.3 | vulnerable | | secure\_firewall\_management\_center | 7.4.2.4 | 7.4.2.4 | vulnerable | | secure\_firewall\_management\_center | 7.4.3 | 7.4.3 | vulnerable | | secure\_firewall\_management\_center | 7.4.4 | 7.4.4 | vulnerable | | secure\_firewall\_management\_center | 7.4.5 | 7.4.5 | vulnerable | | secure\_firewall\_management\_center | 7.6.0 | 7.6.0 | vulnerable | | secure\_firewall\_management\_center | 7.6.1 | 7.6.1 | vulnerable | | secure\_firewall\_management\_center | 7.6.2 | 7.6.2 | vulnerable | | secure\_firewall\_management\_center | 7.6.2.1 | 7.6.2.1 | vulnerable | | secure\_firewall\_management\_center | 7.6.3 | 7.6.3 | vulnerable | | secure\_firewall\_management\_center | 7.6.4 | 7.6.4 | vulnerable | | secure\_firewall\_management\_center | 7.7.0 | 7.7.0 | vulnerable | | secure\_firewall\_management\_center | 7.7.10 | 7.7.10 | vulnerable | | secure\_firewall\_management\_center | 7.7.10.1 | 7.7.10.1 | vulnerable | | secure\_firewall\_management\_center | 7.7.11 | 7.7.11 | vulnerable | | secure\_firewall\_management\_center | 10.0.0 | 10.0.0 | vulnerable | ## Related weakness (CWE) CWE-502 ## Remediation plan 1 ### Apply official patches Consult the Cisco Security Advisory (cisco-sa-fmc-rce-NKhnULJh) to identify and install the specific software updates provided by Cisco to address this insecure deserialization vulnerability. 2 ### Update affected systems Upgrade Cisco FMC software to fixed releases, ensuring all vulnerable versions across the 6.4, 7.0, 7.1, 7.2, 7.3, 7.4, 7.6, and 7.7 branches are patched or moved to a supported, secure version. 3 ### Restrict access Immediately isolate the FMC web-based management interface from the public internet. Use VPNs, jump hosts, or access control lists (ACLs) to ensure only trusted internal IP addresses can reach the interface. 4 ### Monitor for exploitation Review system logs for unauthorized root-level access, unusual Java process spawns, or suspicious HTTP POST requests directed at the management interface that may contain serialized Java objects. ## Detection Guidance Detection should focus on identifying malicious Java deserialization attempts within HTTP traffic to the FMC management interface. Monitor web server logs for high volumes of POST requests to endpoints processing user-supplied data or those containing common deserialization gadget chain signatures. Additionally, use EDR or system auditing tools to flag any unexpected child processes originating from the web server or Java runtime, particularly those resulting in a root-level shell or unauthorized file modifications. ## References [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh Vendor Advisory ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh)[https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/ Technical Description ](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-20131 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)