CVE-2026-20131

What it actually does

The flaw is an unauthenticated remote code execution vulnerability in the Cisco Secure Firewall Management Center web management interface caused by insecure deserialization of attacker-supplied Java objects. A remote attacker can send a crafted serialized Java byte stream to the management interface, trigger Java object deserialization, and execute arbitrary Java code. Successful exploitation results in code execution with root privileges on the FMC appliance, giving the attacker full control of the management platform and potentially the ability to alter firewall policy, collect credentials or secrets, pivot to managed security devices, and disrupt security operations.

Why it matters to the business

Compromise of a firewall management platform can directly affect network security, outage risk, and incident response capability. Because the vulnerability is network-accessible, requires no authentication, has a critical severity score, is listed in CISA KEV, has been observed in active exploitation, and is associated with ransomware activity, exposed FMC management interfaces should be treated as urgent remediation priorities. A successful attack could allow adversaries to disable or modify firewall controls, steal sensitive configuration data, create persistence, deploy ransomware tooling, or cause operational disruption across environments managed by the affected platform. CISA KEV remediation is due by 2026-03-22 for covered organizations.

How an attack unfolds

An attacker first identifies an exposed Cisco Secure Firewall Management Center web management interface, typically through internet scanning, asset inventory leakage, or targeting of known management IP ranges. The attacker sends a specially crafted Java serialized object to the vulnerable web interface. The application deserializes the untrusted object without adequate validation, causing attacker-controlled Java code or gadget-chain behavior to execute. Because the vulnerable code path runs with elevated privileges, successful exploitation gives the attacker root-level execution on the FMC appliance. From there, the attacker can establish persistence, collect configuration data and credentials, create or modify administrative access, manipulate firewall policy, disable logging or security controls, stage additional malware, and pivot toward devices or networks managed by FMC. Public reporting and KEV context indicate active exploitation in the wild, including activity associated with the Interlock ransomware campaign, so exploitation should be investigated as a realistic scenario rather than a theoretical risk.

How to fix it

Upgrade Cisco Secure Firewall Management Center Software to a Cisco-provided fixed release as specified in the official Cisco security advisory for this vulnerability. No fixed version was provided in the input, so administrators should consult Cisco’s advisory and software download portal for the exact corrected release applicable to each FMC branch. Until patched, remove public internet exposure from the FMC management interface, restrict access to trusted administrative networks only, enforce VPN or bastion-host access, apply firewall ACLs, and block management access from untrusted IP ranges. Where feasible, place FMC behind strong network segmentation and monitoring controls. If exploitation is suspected, do not rely only on patching: collect forensic evidence, rotate administrative credentials and API tokens, review firewall policies and administrator accounts for unauthorized changes, and consider rebuilding or reimaging the appliance from trusted media because successful exploitation grants root access.

How to confirm the fix worked

Confirm exposure by inventorying all Cisco Secure Firewall Management Center deployments and identifying their running software versions, management interface reachability, and access-control posture. Validate that each instance is upgraded to a Cisco fixed release listed in the official advisory. From an external and internal untrusted network perspective, verify that the FMC web management interface is not reachable unless explicitly required and restricted through VPN, bastion, or allowlisted administrative networks. Review management-plane firewall rules and confirm deny-by-default behavior for unauthorized sources. After remediation, monitor for failed or blocked attempts to submit Java serialized payloads, HTTP errors associated with deserialization, and abnormal child processes spawned by Java or web server services. For appliances that were exposed before patching, perform compromise assessment rather than assuming absence of impact.

Typical attack path

1. Scan for Cisco Secure Firewall Management Center web management interfaces reachable from the internet or untrusted networks.
2. Confirm the target exposes the vulnerable management service and is running an affected software version.
3. Send a crafted serialized Java object to the web-based management interface.
4. Trigger insecure Java deserialization and gain arbitrary code execution.
5. Execute commands or Java payloads with root privileges on the FMC appliance.
6. Establish persistence, add or abuse administrative access, and collect credentials, tokens, configuration backups, or policy data.
7. Modify firewall management settings, disable controls, stage tooling, or pivot toward managed devices and internal networks.
8. Use the compromised management plane to support data theft, disruption, or ransomware deployment.

How to detect it

Investigate whether the FMC management interface received suspicious HTTP requests before remediation, especially unauthenticated POST requests, requests with binary payloads, Java serialized stream markers, unusual content types, repeated HTTP 500 responses, or deserialization-related Java exceptions. Review web access logs, application logs, Java/Tomcat logs, system logs, audit logs, authentication logs, and command execution history where available. Hunt for root-level activity that should not originate from the web management process, including shell execution, file downloads, archive extraction, cron or systemd persistence, new local users, SSH key additions, unexpected changes to administrator accounts, and modifications to firewall policies or deployment jobs. Correlate inbound management-plane requests with subsequent outbound connections from the FMC appliance to unfamiliar IP addresses, especially over HTTP, HTTPS, SSH, DNS tunneling, or uncommon ports. Because exploitation has been associated with ransomware activity, also check for staging directories, encryption tooling, credential theft utilities, disabled logging, backup deletion, and lateral movement attempts. If logs are incomplete or tampered with, treat that as a potential compromise signal given the root-level impact.

• AC ED 00 05
• aced0005
• java.io.ObjectInputStream
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.OptionalDataException
• java.io.WriteAbortedException
• ClassNotFoundException
• InvalidClassException
• StreamCorruptedException: invalid stream header
• Content-Type: application/x-java-serialized-object
• application/x-java-serialized-object
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/messages
• /var/log/secure
• /var/log/audit/audit.log
• /etc/cron.d/
• /etc/crontab
• /root/.ssh/authorized_keys
• /tmp/
• /var/tmp/
• wget http
• curl http
• bash -c
• /bin/sh -c
• chmod +x
• nc -e
• ncat -e
• python -c
• perl -e
• openssl s_client
• Interlock

What your security team should do

• Immediately identify all Cisco Secure Firewall Management Center instances and determine whether the web management interface is reachable from the internet or other untrusted networks.
• Treat internet-exposed affected FMC systems as high-priority due to unauthenticated root remote code execution, KEV status, active exploitation, and ransomware association.
• Upgrade to the Cisco fixed release for the applicable FMC software branch as soon as available and confirmed for the deployed version.
• Before or during patching, restrict management access to trusted administrative networks, VPNs, or bastion hosts; block all public access to the FMC management interface.
• Perform threat hunting on exposed or previously exposed FMC systems for signs of Java deserialization exploitation, unexpected root-level command execution, unauthorized accounts, policy changes, persistence, and outbound connections.
• If indicators of compromise are found, isolate the appliance, preserve forensic artifacts, rotate credentials and secrets, validate firewall policy integrity, and rebuild from trusted media if root compromise cannot be ruled out.
• Review managed firewall devices for unauthorized configuration changes pushed from FMC after the suspected exposure window.
• Increase monitoring for management-plane access attempts, unusual HTTP POST traffic containing Java serialization markers, deserialization exceptions, and suspicious processes spawned by Java or web services.
• Track CISA KEV deadlines and ensure covered systems are remediated by 2026-03-22 or earlier.