CVE-2026-20131

Overview

CVE-2026-20131 is a critical unauthenticated remote code execution vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC). The flaw stems from insecure deserialization of user-supplied Java byte streams (CWE-502). An attacker can send a crafted serialized Java object to the management interface to achieve arbitrary code execution as root on the underlying Linux system — with no authentication required.

This is a maximum severity vulnerability: CVSS 10.0, network-accessible, no authentication, no user interaction, and the attacker gains root-level access with cross-scope impact (Scope: Changed). The Interlock ransomware group weaponized this as a zero-day to compromise enterprise firewall infrastructure and deploy a full operational toolkit including RATs, webshells, and ransomware payloads.

Zero-Day Exploitation: Interlock Ransomware Campaign

Amazon's threat intelligence team, using their MadPot global honeypot sensor network, identified Interlock ransomware exploiting this vulnerability 36 days before Cisco's public disclosure. A misconfigured Interlock infrastructure server exposed the group's complete operational toolkit, giving researchers rare visibility into a ransomware operation's full attack chain.

Attack Timeline

Exploitation Technique

The attack involves sending HTTP requests to a specific path in the FMC web interface. Request bodies contain Java code execution attempts along with two embedded URLs:

1. A URL to deliver configuration data supporting the exploit
2. A URL designed to confirm successful exploitation by causing the vulnerable target to perform an HTTP PUT request and upload a generated file

Upon successful exploitation, Interlock fetches and executes a malicious ELF binary (Linux executable) from a remote staging server, beginning post-compromise operations.

Interlock's Operational Toolkit

The exposed infrastructure revealed a sophisticated multi-stage attack chain:

Threat Actor Profile: Interlock

Vulnerability Description

The vulnerability resides in the web-based management interface of Cisco FMC. The interface accepts user-supplied data and passes it through a Java deserialization pathway without adequate validation or filtering. An attacker crafts a malicious serialized Java object (a "gadget chain") that, when deserialized by the server's JVM, triggers arbitrary code execution.

Why Java Deserialization Is Dangerous

• Automatic code execution: Java's ObjectInputStream.readObject() can invoke arbitrary methods during deserialization if the classpath contains exploitable "gadget" classes (e.g., from Apache Commons Collections, Spring, etc.).
• Root privileges: The FMC web service runs with elevated (root) privileges on the underlying Linux OS, so successful deserialization exploits grant immediate root access.
• No authentication barrier: The vulnerable endpoint is accessible to unauthenticated remote users, meaning any network-reachable attacker can exploit it.
• Cross-scope impact: FMC manages and configures Cisco Secure Firewalls. Compromising FMC gives an attacker control over the entire firewall fleet, enabling policy manipulation, traffic interception, and lateral movement into protected networks.

Affected Versions

Cisco Secure Firewall Management Center Software versions spanning nearly the entire product line are affected. The NVD lists specific point releases across multiple major version branches.

Affected Version Branches

Also Affected

Indicators of Compromise (Selected)

From Amazon's threat intelligence report on the Interlock campaign:

Exploit Source IPs

C2 & Staging Infrastructure

Exploit Support Domains

C2 Domains

TLS Fingerprints

Mitigation & Remediation

Immediate Actions

• Apply Cisco's security patches immediately — this is a maximum-severity zero-day with confirmed ransomware exploitation.
• Restrict management interface access — ensure FMC web interfaces are not exposed to the public internet. Use dedicated management networks with strict ACLs.
• Review logs for IOCs — search for the exploit source IPs, domains, and TLS fingerprints listed above.
• Hunt for post-compromise artifacts — look for unauthorized ScreenConnect installations, PowerShell scripts staging data to network shares, and unusual Java ServletRequestListener registrations.

Detection Opportunities

• Monitor for PowerShell scripts staging data to network shares with hostname-based directory structures
• Detect Java ServletRequestListener registrations in web application contexts
• Identify HAProxy installations with aggressive log deletion cron jobs
• Watch for TCP connections to unusual high-numbered ports (e.g., 45588)
• Alert on HTTP PUT requests originating from FMC systems to external hosts

Long-Term Measures

• Implement network segmentation to isolate management planes from production traffic
• Deploy defense-in-depth controls — assume any single security device can be compromised
• Maintain centralized, tamper-resistant logging separate from managed infrastructure
• Regularly audit Active Directory Certificate Services configurations (the Certify tool targets AD CS misconfigurations)
• Test incident response procedures specifically for security infrastructure compromise scenarios