---
title: "Cisco FMC CVE-2026-20131: Interlock Zero-Day Root RCE"
url: https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20131-deserialization-rce/
description: "Pre-auth Java deserialization RCE as root in Cisco Secure FMC, used by Interlock ransomware before the March 2026 fix. Confirm upgrades and hunt for implants."
type: security-brief
section: "Security Digest"
date_published: 2026-03-04
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-20131"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco FMC CVE-2026-20131: Interlock Zero-Day Root RCE

**Verdict: Check exposure.** Fixed since March 2026, but Interlock used it as a zero-day from January; make sure every on-prem FMC is on a September 2026 hardening release, and hunt for Interlock footprints on any FMC that was reachable before the fix.

- **Who must act:** Teams running on-premises Cisco Secure Firewall Management Center, especially any whose web interface was reachable from the internet or broad internal networks between January and March 2026.
- **Who can relax:** Customers using only Security Cloud Control Firewall Management, which Cisco patched itself, and sites that run ASA or FTD without an FMC, which Cisco lists as not affected.
- **Affected:** Cisco Secure FMC 6.4.0.13 through 6.4.0.18; Cisco Secure FMC 7.0.0 through 7.0.8.1; Cisco Secure FMC 7.1.x and 7.3.x (all listed builds); Cisco Secure FMC 7.2.0 through 7.2.10.2; Cisco Secure FMC 7.4.0 through 7.4.5; Cisco Secure FMC 7.6.0 through 7.6.4; Cisco Secure FMC 7.7.0 through 7.7.11; Cisco Secure FMC 10.0.0; Cisco Security Cloud Control Firewall Management (SaaS, fixed by Cisco)
- **Fixed:** First-fixed release per train: see Cisco Software Checker (the advisory lists no table); Current target: September 2026 hardening releases 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0, which also fix CVE-2026-20079 and CVE-2026-20316
- **CVEs:** CVE-2026-20131
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record the version of every on-prem FMC (show version, or Help > About) and check it in Cisco's Software Checker.
2. Upgrade to the September 2026 hardening release for your train; move 6.4, 7.1 and 7.3 systems to a supported train.
3. Keep the FMC web interface off the internet and reachable only from an admin network or jump host.
4. If an FMC was reachable and unpatched in early 2026, hunt for the Interlock indicators Amazon published and check for unapproved ScreenConnect installs.
5. If you find signs of compromise, open a Cisco TAC case, rebuild the FMC, and rotate every credential it stores or can reach.

### How to check if you are affected

- Search firewall and proxy logs for the exploit source IPs 206.251.239.164, 199.217.98.153 and 89.46.237.33 and for traffic to Interlock C2 such as 144.172.94.59 and 199.217.99.121.
- Look for FMC or Linux hosts with unexpected HAProxy installs, cron jobs that truncate /var/log, or listeners on TCP 45588.
- Check for unapproved ConnectWise ScreenConnect agents and for Certify or Volatility on Windows hosts.
- Enable Snort rules 66082 and 66083 where sensors can see FMC management traffic.

## What happened

On March 4, 2026, Cisco disclosed [CVE-2026-20131](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh), an insecure deserialization flaw (CWE-502) in the web interface of Cisco Secure Firewall Management Center (FMC). An unauthenticated attacker sends a crafted serialized Java object and gets arbitrary Java code running as root. Cisco scores it CVSS 3.1 10.0. A Cisco engineer found it in internal testing.

It was not new to everyone. On March 18, [Amazon Threat Intelligence](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/) reported that the Interlock ransomware group "was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026." Amazon's MadPot sensors caught the exploit. A misconfigured attacker staging server then exposed the toolkit. It included a PowerShell reconnaissance script, JavaScript and Java remote access trojans, a memory-resident Java web shell, a Bash script that turned Linux hosts into HAProxy relays and wiped logs, and abused ScreenConnect, Volatility and Certify. Cisco updated its advisory the same day to say it was aware of attempted exploitation. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131) on March 19, set a March 22 deadline, and marks it as used in ransomware campaigns.

## Who is affected

On-premises FMC is affected "regardless of device configuration." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-20131) lists builds from 6.4.0.13 up to 7.0.8.1, 7.2.10.2, 7.4.5, 7.6.4, 7.7.11 and 10.0.0, plus the 7.1 and 7.3 trains. Cisco's advisory gives no per-train table and points to its Software Checker instead. Security Cloud Control Firewall Management was also affected, but Cisco deployed the fix to that SaaS service, and no customer action is needed. ASA and FTD software are not affected. There is no workaround.

## Do you really need to act?

For most FMC owners, this is now about confirmation and hunting. Every September 2026 hardening release listed in the [CVE-2026-20079 advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2) is a later build than the last affected build in its train. Those releases also fix CVE-2026-20079 and the static-credential bug CVE-2026-20316, both exploited since. So if you are on a hardening release, you are covered for all three.

Two cases still need work. An FMC that is not on a hardening release is exposed to several exploited bugs at once, so treat it as urgent. And an FMC that was reachable before March 2026 may already hold an Interlock foothold. An upgrade does not remove one. Amazon notes the web shell runs only in memory and that Interlock varied file hashes per target, so a clean file scan proves little.

## What to do now

1. List every on-prem FMC and its version with `show version` or Help > About, and check each in Cisco's Software Checker.
2. Upgrade to the hardening release for your train: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0. Move 6.4, 7.1 and 7.3 systems to a supported train.
3. Restrict the FMC web interface to an admin network or jump host. Cisco says the attack surface is reduced without public internet access.
4. For any FMC that was reachable in early 2026, run the hunt below. If anything turns up, open a TAC case, rebuild, and rotate every credential the FMC holds.

## How to tell if you were hit

Amazon's post lists exploit source IPs `206.251.239.164`, `199.217.98.153` and `89.46.237.33`, C2 addresses including `144.172.94.59` and `199.217.99.121`, and lookalike domains such as `os-update-server[.]com` and `browser-updater[.]live`. Search firewall, DNS and proxy logs back to January 2026. On hosts, look for unexpected HAProxy installs with cron jobs that truncate `/var/log`, listeners on TCP 45588, unapproved ScreenConnect agents, and Certify or Volatility binaries. Cisco's advisory links Snort rules 66082 and 66083 for the exploit. [The Hacker News](https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html) has a summary.

## Timeline

- Jan 26, 2026 — Amazon sees Interlock exploiting the flaw as a zero-day.
- Mar 4, 2026 — Cisco publishes the advisory and fixed software.
- Mar 18, 2026 — Amazon publishes its Interlock report. Cisco notes attempted exploitation.
- Mar 19, 2026 — CISA adds the CVE to KEV with known ransomware use.
- Sep 16, 2026 — Cisco ships FMC hardening releases that bundle later fixes.

## Sources

1. [Cisco — Secure Firewall Management Center Software Remote Code Execution Vulnerability (cisco-sa-fmc-rce-NKhnULJh)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh)
2. [Amazon Threat Intelligence — Interlock ransomware campaign targeting enterprise firewalls](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/)
3. [CVE record — CVE-2026-20131](https://www.cve.org/CVERecord?id=CVE-2026-20131)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-20131](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131)
5. [Cisco — Secure FMC Authentication Bypass Remote Code Execution Vulnerability (cisco-sa-onprem-fmc-authbypass-5JPp45V2)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2)
6. [Cisco — Secure FMC Static Credential Vulnerability (cisco-sa-fmc-static-cred-BET3Cjh)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh)
7. [The Hacker News — Interlock ransomware exploits Cisco FMC zero-day](https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html)

---
Source page: https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20131-deserialization-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt