CVE-2026-20131

CRITICAL10.0

CISA KEV

Published 2026-03-04 · Updated 2026-06-17 · Source psirt@cisco.com

Summary

CVE-2026-20131 is a critical-severity (CVSS 10.0) vulnerability in Cisco Secure Firewall Management Center (FMC). CISA added it to the Known Exploited Vulnerabilities catalog on March 19, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 22, 2026. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Cisco has 101 vulnerabilities in the KEV catalog, 7 of them linked to ransomware.

All 101 known-exploited Cisco vulnerabilities →

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-502

CISA Known-Exploited Vulnerability

Product: Cisco — Secure Firewall Management Center (FMC)

Name: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Date added: 2026-03-19 · Due: 2026-03-22

USED IN RANSOMWARE

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Cisco vulnerabilities

Most recently added to CISA KEV

CVE-2026-76519
Secure Email Gateway — Cisco Secure Email Gateway Relative Path Traversal Vulnerability
added 2026-10-14
CVE-2026-76504
Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
added 2026-09-30
CVE-2026-76460
Identity Services Engine — Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
added 2026-09-16
CVE-2026-76461
Secure Email Gateway — Cisco Secure Email Gateway SQL Injection Vulnerability
added 2026-09-14
CVE-2026-20079
Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management — Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
added 2026-09-09
CVE-2026-20349
Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
added 2026-08-11

View all →

Related CVEs

Same severity, most recent

CVE-2026-104736
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
2026-10-17 · score 9.8
CVE-2026-110653
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
2026-10-17 · score 9.1
CVE-2026-111823
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
2026-10-17 · score 9.8
CVE-2026-102608
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
2026-10-16 · score 9.0
CVE-2026-111711
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
2026-10-16 · score 9.8