erroneo.us
Search all guides⌘K

Security Digest · Mar 4, 2026 · Vulnerability · Network edge

Cisco FMC CVE-2026-20131: Interlock Zero-Day Root RCE

Pre-auth Java deserialization RCE as root in Cisco Secure FMC, used by Interlock ransomware before the March 2026 fix. Confirm upgrades and hunt for implants.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

Fixed since March 2026, but Interlock used it as a zero-day from January; make sure every on-prem FMC is on a September 2026 hardening release, and hunt for Interlock footprints on any FMC that was reachable before the fix.

Who must act: Teams running on-premises Cisco Secure Firewall Management Center, especially any whose web interface was reachable from the internet or broad internal networks between January and March 2026.

Who can relax: Customers using only Security Cloud Control Firewall Management, which Cisco patched itself, and sites that run ASA or FTD without an FMC, which Cisco lists as not affected.

Affected
Cisco Secure FMC 6.4.0.13 through 6.4.0.18
Cisco Secure FMC 7.0.0 through 7.0.8.1
Cisco Secure FMC 7.1.x and 7.3.x (all listed builds)
Cisco Secure FMC 7.2.0 through 7.2.10.2
Cisco Secure FMC 7.4.0 through 7.4.5
Cisco Secure FMC 7.6.0 through 7.6.4
Cisco Secure FMC 7.7.0 through 7.7.11
Cisco Secure FMC 10.0.0
Cisco Security Cloud Control Firewall Management (SaaS, fixed by Cisco)
Fixed in
First-fixed release per train: see Cisco Software Checker (the advisory lists no table)
Current target: September 2026 hardening releases 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0, which also fix CVE-2026-20079 and CVE-2026-20316
CVSS
10.0 (v3.1, vendor)
EPSS
43.2% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Record the version of every on-prem FMC (show version, or Help > About) and check it in Cisco's Software Checker.
  2. Upgrade to the September 2026 hardening release for your train; move 6.4, 7.1 and 7.3 systems to a supported train.
  3. Keep the FMC web interface off the internet and reachable only from an admin network or jump host.
  4. If an FMC was reachable and unpatched in early 2026, hunt for the Interlock indicators Amazon published and check for unapproved ScreenConnect installs.
  5. If you find signs of compromise, open a Cisco TAC case, rebuild the FMC, and rotate every credential it stores or can reach.

How to check if you are affected or compromised

  • Search firewall and proxy logs for the exploit source IPs 206.251.239.164, 199.217.98.153 and 89.46.237.33 and for traffic to Interlock C2 such as 144.172.94.59 and 199.217.99.121.
  • Look for FMC or Linux hosts with unexpected HAProxy installs, cron jobs that truncate /var/log, or listeners on TCP 45588.
  • Check for unapproved ConnectWise ScreenConnect agents and for Certify or Volatility on Windows hosts.
  • Enable Snort rules 66082 and 66083 where sensors can see FMC management traffic.

What happened#

On March 4, 2026, Cisco disclosed CVE-2026-20131, an insecure deserialization flaw (CWE-502) in the web interface of Cisco Secure Firewall Management Center (FMC). An unauthenticated attacker sends a crafted serialized Java object and gets arbitrary Java code running as root. Cisco scores it CVSS 3.1 10.0. A Cisco engineer found it in internal testing.

It was not new to everyone. On March 18, Amazon Threat Intelligence reported that the Interlock ransomware group "was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026." Amazon's MadPot sensors caught the exploit. A misconfigured attacker staging server then exposed the toolkit. It included a PowerShell reconnaissance script, JavaScript and Java remote access trojans, a memory-resident Java web shell, a Bash script that turned Linux hosts into HAProxy relays and wiped logs, and abused ScreenConnect, Volatility and Certify. Cisco updated its advisory the same day to say it was aware of attempted exploitation. CISA added the CVE to the KEV catalog on March 19, set a March 22 deadline, and marks it as used in ransomware campaigns.

Who is affected#

On-premises FMC is affected "regardless of device configuration." The CVE record lists builds from 6.4.0.13 up to 7.0.8.1, 7.2.10.2, 7.4.5, 7.6.4, 7.7.11 and 10.0.0, plus the 7.1 and 7.3 trains. Cisco's advisory gives no per-train table and points to its Software Checker instead. Security Cloud Control Firewall Management was also affected, but Cisco deployed the fix to that SaaS service, and no customer action is needed. ASA and FTD software are not affected. There is no workaround.

Do you really need to act?#

For most FMC owners, this is now about confirmation and hunting. Every September 2026 hardening release listed in the CVE-2026-20079 advisory is a later build than the last affected build in its train. Those releases also fix CVE-2026-20079 and the static-credential bug CVE-2026-20316, both exploited since. So if you are on a hardening release, you are covered for all three.

Two cases still need work. An FMC that is not on a hardening release is exposed to several exploited bugs at once, so treat it as urgent. And an FMC that was reachable before March 2026 may already hold an Interlock foothold. An upgrade does not remove one. Amazon notes the web shell runs only in memory and that Interlock varied file hashes per target, so a clean file scan proves little.

What to do now#

  1. List every on-prem FMC and its version with show version or Help > About, and check each in Cisco's Software Checker.
  2. Upgrade to the hardening release for your train: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0. Move 6.4, 7.1 and 7.3 systems to a supported train.
  3. Restrict the FMC web interface to an admin network or jump host. Cisco says the attack surface is reduced without public internet access.
  4. For any FMC that was reachable in early 2026, run the hunt below. If anything turns up, open a TAC case, rebuild, and rotate every credential the FMC holds.

How to tell if you were hit#

Amazon's post lists exploit source IPs 206.251.239.164, 199.217.98.153 and 89.46.237.33, C2 addresses including 144.172.94.59 and 199.217.99.121, and lookalike domains such as os-update-server[.]com and browser-updater[.]live. Search firewall, DNS and proxy logs back to January 2026. On hosts, look for unexpected HAProxy installs with cron jobs that truncate /var/log, listeners on TCP 45588, unapproved ScreenConnect agents, and Certify or Volatility binaries. Cisco's advisory links Snort rules 66082 and 66083 for the exploit. The Hacker News has a summary.

Timeline#

  • — Amazon sees Interlock exploiting the flaw as a zero-day.
  • — Cisco publishes the advisory and fixed software.
  • — Amazon publishes its Interlock report. Cisco notes attempted exploitation.
  • — CISA adds the CVE to KEV with known ransomware use.
  • — Cisco ships FMC hardening releases that bundle later fixes.

Vulnerability records

  • CVE-2026-20131 · KEV 2026-03-19 · A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Secure Firewall Management Center Software Remote Code Execution Vulnerability (cisco-sa-fmc-rce-NKhnULJh) sec.cloudapps.cisco.com
  2. Amazon Threat Intelligence — Interlock ransomware campaign targeting enterprise firewalls aws.amazon.com
  3. CVE record — CVE-2026-20131 cve.org
  4. CISA — Known Exploited Vulnerabilities: CVE-2026-20131 cisa.gov
  5. Cisco — Secure FMC Authentication Bypass Remote Code Execution Vulnerability (cisco-sa-onprem-fmc-authbypass-5JPp45V2) sec.cloudapps.cisco.com
  6. Cisco — Secure FMC Static Credential Vulnerability (cisco-sa-fmc-static-cred-BET3Cjh) sec.cloudapps.cisco.com

Coverage and analysis

  1. The Hacker News — Interlock ransomware exploits Cisco FMC zero-day thehackernews.com