CVE-2026-20131

Cisco Secure Firewall Management Center (FMC): Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data

As of , CVE-2026-20131 in Cisco Secure Firewall Management Center (FMC) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.

Exploited
Yes: CISA listed it on 19 March 2026
US federal deadline
22 March 20263 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.43Higher than 98% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: sec.cloudapps.cisco.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA's required action

What the flaw is

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

CISA's description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

The CVE record's description, from cisco

CVE published
4 March 2026
Assigned by
cisco
CVSS
10.0 Critical (CVSS 3.1, from the CNA)
CWE-502
Deserialization of Untrusted Data
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Secure Firewall Management Center (FMC): other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-20316Secure Firewall Management Center Use of Hard-coded PasswordCisco Secure Firewall Management Center (FMC)Patch nowRansomware use, listed within a year0.35

Read further