- Critical 10.0
- Known exploited (CISA KEV)
- Used in ransomware (CISA)
CVE-2026-20131
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the…
Scores
The facts
- Published
- 4 March 2026
- Last changed
- 17 June 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 10.0 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- Affects
- cisco secure firewall management center
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 19 March 2026. CISA lists it as used in ransomware campaigns.
- EPSS
- 43.2% chance of exploitation activity in the next 30 days (percentile 99).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.