CVE-2026-20131
📛 CVE Title
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
Description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- cisco
- CVSS severity
- CRITICAL
- CVSS score
- 10.0 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Effective score
- 10.0 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-502 - Reserved
- 2025-10-08
- Published
- 2026-03-04 17:17 UTC
- Last updated
- 2026-03-25 16:04 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20131.json
- Linked Threat
- CVE-2026-20131 — Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
CISA Known Exploited Vulnerabilities CISA KEV
CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.
- Vulnerability name
- Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
- Vendor / project
- Cisco
- Product
- Secure Firewall Management Center (FMC)
- Date added to KEV
- 2026-03-19
- Remediation due
- 2026-03-22
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Ransomware campaign use
- Known
- CISA notes
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131
- CISA listing
- www.cisa.gov/known-exploited-vulnerabilities-catalog
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-03-04 18:16:27 UTC
- NVD last modified
- 2026-03-25 17:39:46 UTC
- NVD CVSS v3.1
- 10.0 / 10 CRITICAL source: psirt@cisco.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 6.0 / 10
- EPSS score
- 0.0114 (probability of exploitation in next 30 days)
- EPSS percentile
- 78.66% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD / KEV / EPSS data refreshed 2026-05-25 04:17 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-9444 - Assigner
- cisco
- Published
- Mar 4, 2026, 5:17:56 PM
- Updated
- Mar 25, 2026, 4:04:35 PM
- EUVD base score (CVSS 3.1)
-
10.0 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EUVD-reported EPSS
- 1.4000
- Vendors
- Cisco
- Products
-
Cisco Secure Firewall Management Center (FMC) (7.0.6.2)Cisco Secure Firewall Management Center (FMC) (7.6.2)Cisco Secure Firewall Management Center (FMC) (7.7.11)Cisco Secure Firewall Management Center (FMC) (7.2.10)Cisco Secure Firewall Management Center (FMC) (7.4.4)Cisco Secure Firewall Management Center (FMC) (7.4.2)Cisco Secure Firewall Management Center (FMC) (7.2.9)Cisco Secure Firewall Management Center (FMC) (6.4.0.13)Cisco Secure Firewall Management Center (FMC) (7.2.8)Cisco Secure Firewall Management Center (FMC) (7.0.5)Cisco Secure Firewall Management Center (FMC) (7.0.8.1)Cisco Secure Firewall Management Center (FMC) (7.0.3)Cisco Secure Firewall Management Center (FMC) (7.4.1.1)Cisco Secure Firewall Management Center (FMC) (7.0.2.1)Cisco Secure Firewall Management Center (FMC) (7.0.6.1)Cisco Secure Firewall Management Center (FMC) (7.2.4)Cisco Secure Firewall Management Center (FMC) (7.0.6)Cisco Secure Firewall Management Center (FMC) (7.2.3)Cisco Secure Firewall Management Center (FMC) (7.2.5)Cisco Secure Firewall Management Center (FMC) (7.7.0)Cisco Secure Firewall Management Center (FMC) (7.2.0)Cisco Secure Firewall Management Center (FMC) (7.0.6.3)Cisco Secure Firewall Management Center (FMC) (7.0.0)Cisco Secure Firewall Management Center (FMC) (7.6.2.1)Cisco Secure Firewall Management Center (FMC) (7.4.2.4)Cisco Secure Firewall Management Center (FMC) (7.0.0.1)Cisco Secure Firewall Management Center (FMC) (7.2.3.1)Cisco Secure Firewall Management Center (FMC) (7.6.3)Cisco Secure Firewall Management Center (FMC) (6.4.0.16)Cisco Secure Firewall Management Center (FMC) (7.2.5.2)Cisco Secure Firewall Management Center (FMC) (7.2.10.2)Cisco Secure Firewall Management Center (FMC) (7.3.0)Cisco Secure Firewall Management Center (FMC) (7.3.1.1)Cisco Secure Firewall Management Center (FMC) (6.4.0.14)Cisco Secure Firewall Management Center (FMC) (7.6.1)Cisco Secure Firewall Management Center (FMC) (7.2.2)Cisco Secure Firewall Management Center (FMC) (7.4.5)Cisco Secure Firewall Management Center (FMC) (7.6.4)Cisco Secure Firewall Management Center (FMC) (7.0.2)Cisco Secure Firewall Management Center (FMC) (7.4.0)Cisco Secure Firewall Management Center (FMC) (7.0.1)Cisco Secure Firewall Management Center (FMC) (7.2.8.1)Cisco Secure Firewall Management Center (FMC) (7.2.0.1)Cisco Secure Firewall Management Center (FMC) (7.0.7)Cisco Secure Firewall Management Center (FMC) (10.0.0)Cisco Secure Firewall Management Center (FMC) (7.0.1.1)Cisco Secure Firewall Management Center (FMC) (7.3.1.2)Cisco Secure Firewall Management Center (FMC) (7.4.2.3)Cisco Secure Firewall Management Center (FMC) (7.7.10)Cisco Secure Firewall Management Center (FMC) (7.3.1)Cisco Secure Firewall Management Center (FMC) (6.4.0.17)Cisco Secure Firewall Management Center (FMC) (7.2.5.1)Cisco Secure Firewall Management Center (FMC) (7.1.0)Cisco Secure Firewall Management Center (FMC) (7.4.2.1)Cisco Secure Firewall Management Center (FMC) (7.0.8)Cisco Secure Firewall Management Center (FMC) (7.4.2.2)Cisco Secure Firewall Management Center (FMC) (6.4.0.18)Cisco Secure Firewall Management Center (FMC) (7.1.0.3)Cisco Secure Firewall Management Center (FMC) (7.7.10.1)Cisco Secure Firewall Management Center (FMC) (7.1.0.1)Cisco Secure Firewall Management Center (FMC) (7.6.0)Cisco Secure Firewall Management Center (FMC) (7.4.3)Cisco Secure Firewall Management Center (FMC) (7.1.0.2)Cisco Secure Firewall Management Center (FMC) (7.4.1)Cisco Secure Firewall Management Center (FMC) (6.4.0.15)Cisco Secure Firewall Management Center (FMC) (7.2.4.1)Cisco Secure Firewall Management Center (FMC) (7.2.6)Cisco Secure Firewall Management Center (FMC) (7.0.4)Cisco Secure Firewall Management Center (FMC) (7.2.10.1)Cisco Secure Firewall Management Center (FMC) (7.2.7)Cisco Secure Firewall Management Center (FMC) (7.2.1)
- Aliases
-
GHSA-r229-mj76-g2qx
ENISA description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Management Center (FMC) |
7.0.0 (affected),
7.0.0.1 (affected),
7.0.1 (affected),
7.1.0 (affected),
6.4.0.13 (affected),
7.0.1.1 (affected),
6.4.0.14 (affected),
7.1.0.1 (affected),
7.0.2 (affected),
6.4.0.15 (affected),
7.2.0 (affected),
7.0.2.1 (affected),
7.0.3 (affected),
7.1.0.2 (affected),
7.2.0.1 (affected),
7.0.4 (affected),
7.2.1 (affected),
7.0.5 (affected),
6.4.0.16 (affected),
7.3.0 (affected),
7.2.2 (affected),
7.3.1 (affected),
7.2.3 (affected),
7.1.0.3 (affected),
7.2.3.1 (affected),
7.2.4 (affected),
7.0.6 (affected),
7.2.4.1 (affected),
7.2.5 (affected),
7.3.1.1 (affected),
7.4.0 (affected),
6.4.0.17 (affected),
7.0.6.1 (affected),
7.2.5.1 (affected),
7.4.1 (affected),
7.2.6 (affected),
7.4.1.1 (affected),
7.0.6.2 (affected),
6.4.0.18 (affected),
7.2.7 (affected),
7.2.5.2 (affected),
7.3.1.2 (affected),
7.2.8 (affected),
7.6.0 (affected),
7.4.2 (affected),
7.2.8.1 (affected),
7.0.6.3 (affected),
7.4.2.1 (affected),
7.2.9 (affected),
7.0.7 (affected),
7.7.0 (affected),
7.4.2.2 (affected),
7.2.10 (affected),
7.6.1 (affected),
7.4.2.3 (affected),
7.0.8 (affected),
7.6.2 (affected),
7.7.10 (affected),
7.2.10.1 (affected),
7.0.8.1 (affected),
7.6.2.1 (affected),
7.2.10.2 (affected),
7.7.10.1 (affected),
7.4.2.4 (affected),
7.4.3 (affected),
7.7.11 (affected),
7.6.4 (affected),
10.0.0 (affected),
7.4.4 (affected),
7.4.5 (affected)
|
— |
Affected products — CPE 2.3 (71) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.13:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.14:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.15:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.16:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.17:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.4.0.18:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.6.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.7:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.0.8.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.1.0.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.3.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.4.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.5.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.7:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.8.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.9:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.2.10.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.3.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.3.1.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.2.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.4.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.6.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.6.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.6.2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.6.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.6.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.7.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.7.10.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:7.7.11:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:10.0.0:*:*:*:*:*:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (6)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/502.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2026-20131 rapid7:attackerkb.com
- https://nvd.nist.gov/vuln/detail/CVE-2026-20131 rapid7:nvd.nist.gov
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh rapid7:sec.cloudapps.cisco.com
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog rapid7:www.cisa.gov
- https://www.cve.org/CVERecord?id=CVE-2026-20131 rapid7:www.cve.org
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/ 134c704f-9b21-4f2e-91b3-4a467353bcc0 Technical Description
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh psirt@cisco.com Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
Indicators (2)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| cwe |
CWE-502
|
no local data | 2026-05-14 02:58 UTC |
| cve |
CVE-2026-20131
|
no local data | 2026-05-14 02:58 UTC |
Remediations (1)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
CISA KEV
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-03-22 Known ransomware campaign use: Known
2026-05-14 01:13 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-20131.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20131",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-03-19",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-20T03:55:40.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-19T00:00:00.000Z",
"value": "CVE-2026-20131 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Secure Firewall Management Center (FMC)",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.0.1"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.1.0"
},
{
"status": "affected",
"version": "6.4.0.13"
},
{
"status": "affected",
"version": "7.0.1.1"
},
{
"status": "affected",
"version": "6.4.0.14"
},
{
"status": "affected",
"version": "7.1.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "6.4.0.15"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.0.2.1"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.1.0.2"
},
{
"status": "affected",
"version": "7.2.0.1"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "6.4.0.16"
},
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.2.3"
},
{
"status": "affected",
"version": "7.1.0.3"
},
{
"status": "affected",
"version": "7.2.3.1"
},
{
"status": "affected",
"version": "7.2.4"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.2.4.1"
},
{
"status": "affected",
"version": "7.2.5"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "6.4.0.17"
},
{
"status": "affected",
"version": "7.0.6.1"
},
{
"status": "affected",
"version": "7.2.5.1"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.2.6"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.0.6.2"
},
{
"status": "affected",
"version": "6.4.0.18"
},
{
"status": "affected",
"version": "7.2.7"
},
{
"status": "affected",
"version": "7.2.5.2"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.2.8"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.2.8.1"
},
{
"status": "affected",
"version": "7.0.6.3"
},
{
"status": "affected",
"version": "7.4.2.1"
},
{
"status": "affected",
"version": "7.2.9"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.7.0"
},
{
"status": "affected",
"version": "7.4.2.2"
},
{
"status": "affected",
"version": "7.2.10"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.4.2.3"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.10"
},
{
"status": "affected",
"version": "7.2.10.1"
},
{
"status": "affected",
"version": "7.0.8.1"
},
{
"status": "affected",
"version": "7.6.2.1"
},
{
"status": "affected",
"version": "7.2.10.2"
},
{
"status": "affected",
"version": "7.7.10.1"
},
{
"status": "affected",
"version": "7.4.2.4"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.7.11"
},
{
"status": "affected",
"version": "7.6.4"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.4.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.\r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced."
}
],
"exploits": [
{
"lang": "en",
"value": "In March 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:04:35.907Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-fmc-rce-NKhnULJh",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh"
}
],
"source": {
"advisory": "cisco-sa-fmc-rce-NKhnULJh",
"defects": [
"CSCwt14636"
],
"discovery": "INTERNAL"
},
"title": "Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20131",
"datePublished": "2026-03-04T17:17:56.008Z",
"dateReserved": "2025-10-08T11:59:15.380Z",
"dateUpdated": "2026-03-25T16:04:35.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}