CVE-2026-20131Active Exploitation(cisco / secure_firewall_management_center)

🚨 Cisco Firewall 0-day Vulnerability Exploited in the Wild to Deploy Interlock Ransomware Source: https://cybersecuritynews.com/cisco-firewall-0-day-ransomware/ An active campaign by the Interlock ransomware group is exploiting a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability may allow an unauthenticated remote attacker to execute arbitrary Java code with root privileges on an affected device. The investigation advanced when a misconfigured infrastructure server exposed Interlock’s complete operational toolkit. Initial threat activity involved HTTP requests to a vulnerable software path, containing Java code execution attempts and embedded URLs. #cybersecuritynews #cisco

🚨Alert🚨 CVE-2026-20131 (CVSS 10.0) : Critical Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls 📊 62K+ Services are found on the http://hunter.how yearly. 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22Cisco%20Secure%20Firewall%20Management%20Center%22 👇Query HUNTER : http://product.name="Cisco Secure Firewall Management Center" 📰Refer:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/ https://securityonline.info/critical-10-0-cvss-flaw-in-cisco-secure-fmc-hands-hackers-root-access-to-enterprise-firewalls/ #hunterhow #infosec #infosecurity #OSINT #Vulnerability

صدر اليوم تحذير بخصوص ثغرة في "Cisco Secure Firewall Management Center (FMC)" برقم (CVE-2026-20131) وبتقييم خطورة (10/10). الأخبار "المقلقة" تقول إن الثغرة يتم استغلالها فعلياً (Zero-day) منذ شهر يناير الماضي، يعني قبل الإعلان الرسمي بأسابيع. وش تفاصيل الثغرة؟ 🔵 المشكلة في معالجة البيانات (Insecure Deserialization)؛ وهذا يسمح للمهاجم بإرسال طلبات (HTTP) مُعدة خصيصاً لتنفيذ أكواد Java خبيثة. 🔵 الخطورة هنا أن المهاجم لا يحتاج أي صلاحيات دخول (No Authentication)، وبمجرد الدخول يقدر يوصل لصلاحيات (Root) كاملة على الجهاز. تطورات الهجوم: 🔵 رصدت بعض الباحثين مجموعة (Interlock) وهي تستخدم الثغرة لزرع برمجيات تجسس وتحويل السيرفرات إلى (Proxies) لتغطية نشاطهم الإجرامي. 🔵 الثغرة استُغلت في "الخفاء" لفترة طويلة، وهذا يعني أن مجرد التحديث الآن قد لا يكون كافياً إذا كان النظام قد اختُرق مسبقاً. 💡 نصيحة: 1- الأولوية الآن هي تحديث أنظمة FMC لأحدث إصدار فوراً. 2- مراجعة سجلات الدخول (Logs) من نهاية شهر يناير للتأكد من عدم وجود أي نشاط مشبوه سابق.

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access https://www.bleepingcomputer.com/news/security/interlock-ransomware-exploited-secure-fmc-flaw-in-zero-day-attacks-since-january/

🛡️ We added Cisco Secure Firewall Management Center software and Security Cloud Control vulnerability CVE-2026-20131 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/bTfjUOA1dx

[Blog] Ransomware Interlock explota Zero-Day crítico en Cisco FMC (CVE-2026-20131) https://blog.elhacker.net/2026/03/ransomware-interlock-explota-zero-day.html

Interlock ransomware weaponized a Cisco zero-day (CVE-2026-20131) weeks before detection. Learn how they used fileless web shells and Java RCE in 2026. https://meterpreter.org/the-interlock-chronicles-how-a-cisco-zero-day-fueled-a-month-long-ransomware-rampage/ https://t.co/LhWxZJaopz

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html

Amazon threat intel reveals Interlock ransomware is actively exploiting a critical 10.0 CVSS Cisco zero-day (CVE-2026-20131) to hijack firewall networks. #InterlockRansomware #ZeroDay #CiscoSecurity #CVE #CyberSecurity #InfoSec #Ransomware https://securityonline.info/exploited-in-wild-interlock-ransomware-cisco-zero-day-cve-2026-20131/ https://t.co/PhWBPUQqRC

CVE-2026-20131 (CVSS 10) Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（3/19追加） 🛡️No.1547 CVE-2026-20131 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability ===================================== ✅概要 ・深刻度：緊急🔥 10.0 (CVSS Base) / Cisco (CNA) ・種別：信頼できないデータのデシリアライゼーション (CWE-502) ・CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 事前認証されていない攻撃者がリモートから任意コード実行を行う可能性がある脆弱性。 ✅ChatGPTによる脆弱性評価 ・国内影響度判定：高 ・悪用難易度：低 ✅攻撃前提条件 ・対象システムへネットワーク経由で到達可能 ・脆弱な FMC / SCC バージョンが稼働 ✅悪用時影響 ・未認証での任意コード実行 ・管理基盤の完全掌握 ・ファイアウォールポリシーの改ざん ・ネットワーク全体への侵害拡大 ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開済み ・ITW：CISAがランサムウエア事案での悪用を確認 ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2026-20131 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/ https://www.cisa.gov/news-events/alerts/2026/03/19/cisa-adds-one-known-exploited-vulnerability-catalog #vulnerability

Ciscoのセキュリティアドバイザリが公開されていますね。criticalは2件。 https://sec.cloudapps.cisco.com/security/center/publicationListing.x ▼参考 Cisco warns of max severity Secure FMC flaws giving root access https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/ 『（直訳）認証バイパスの脆弱性 ( CVE-2026-20079 ) により、攻撃者は基盤となるオペレーティング システムのルート アクセスを取得できます。一方、リモート コード実行 (RCE) の脆弱性 ( CVE-2026-20131 ) により、パッチが適用されていないデバイスで攻撃者がルートとして任意の Java コードを実行できます。』

Interlock ransomware group pivots from user-driven attacks to zero-day exploitation, deploying AI-generated Slopoly backdoor to bypass security controls. Active campaign exploited Cisco FMC vulnerability for 36 days before patching. Key technical details: • CVE-2026-20131: Zero-day in Cisco Secure FMC enabling root RCE via crafted HTTP requests with serialized Java • Slopoly backdoor: AI-generated PowerShell C2 framework with WebSocket persistence and real-time communication • Hotta Killer: Custom utility exploiting CVE-2025-61155 in GameDriverX64.sys for kernel-level EDR disabling (T1685) • Memory-resident Java webshells intercept HTTP requests, decrypt commands, execute in-memory to evade AV • LOLBAS abuse: BITSAdmin, PowerShell, AZCopy for staging, lateral movement, and Azure Blob exfiltration (T1567.002) Attack chain methodology: • Phase 1: Shifted from drive-by downloads to direct infrastructure targeting via network edge vulnerabilities • Phase 2-3: Volatility for credential extraction, Certipy for AD CS privilege escalation, NetSupport RAT deployment • Phase 4-5: Advanced Port Scanner reconnaissance, RDP pivoting to DCs/Exchange, HAProxy nodes for exfiltration masking • Phase 6: PsExec domain-wide ransomware deployment with .interlock extension and !__README__!.txt notes Hunt for AZCopy activity to unfamiliar Azure destinations, NetSupport/AnyDesk from servers, and recurring /api/commands HTTP beaconing patterns. #DFIR_Radar

Ransomware Interlock explota Zero-Day crítico en Cisco FMC (CVE-2026-20131) https://unaaldia.hispasec.com/2026/03/ransomware-interlock-explota-zero-day-critico-en-cisco-fmc-cve-2026-20131.html

Interlockは、Cisco Secure Firewall Management Centerの最大深刻度RCE CVE-2026-20131 を、公開前からゼロデイとして悪用していた。重要なのは、2026年1月26日から使われており、Ciscoが3月4日に修正を出すまで36日間、未対策の企業ファイアウォールを直接狙えた点。 この脆弱性は、未認証で任意のJavaコードをroot権限で実行できるもので、Ciscoは3月4日に修正。BleepingComputerによると、Amazonの脅威調査チームがInterlockの実際の悪用を確認している。Interlock自体は2024年9月以降のランサム運用で、ClickFix、NodeSnake、最近ではSlopolyとも関連付けられている。 APT: Interlock Malware: NodeSnake, Slopoly, Interlock ransomware CVE: CVE-2026-20131 IoC: Cisco Secure FMC, unauthenticated Java RCE as root, exploitation since 2026-01-26, patch released 2026-03-04 #CyberSecurity #ThreatIntel #Ransomware #Interlock #Cisco #ZeroDay https://www.bleepingcomputer.com/news/security/interlock-ransomware-exploited-secure-fmc-flaw-in-zero-day-attacks-since-january/

I'm not a vulnerability researcher, but on the basis where there's one vulnerability, there's probably more of the same type; probably some Cisco security appliance, again: CVE-2026-20131 is pretty wild: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh TL;DR: The firewall's management plane (FMC), which shouldn't be exposed to the Internet will run a serialized Java bytestream from an unauthenticated user as root if you send it the right way. It scores 10.0 on CVSS V3.1. If this vulnerability existed, that frankly means that other things are also probably NOT well designed inside.

Grupos de ransomware explotaron la vulnerabilidad CVE-2026-20131, un fallo de severidad grave en el software de Cisco. Esta falla permite a un atacante remoto no autenticado ejecutar código Java arbitrario como usuario root en dispositivos vulnerables. https://www.theregister.com/2026/03/18/amazon_cisco_firewall_0_day_ransomware/ https://t.co/9k2OZGUmCC

Interlock ransomware (GOLD EMBRACE) weaponizes Volatility3 and WinPmem for in-memory credential dumping, moves from ClickFix lure to domain controller in 26 hours, exploiting Cisco zero-day CVE-2026-20131. Key findings: - Initial access via ClickFix social engineering (T1189): user clicked a ChatGPT-referred result, clipboard was read within 5 seconds, then pasted a command pulling PowerShell from afshapiro[.]com, which curl-fetched NodeSnake RAT from 104.236.109[.]139, persisting via Registry Run key (T1547.001). C2 resolved to voginc[.]com at 64.95.11[.]22. - Interlock used winpmem_mini_x64_rc2.exe to capture a raw memory image (mem.raw), then ran vol.exe against it for hashdump (NTLM/LM) and cachedump (cached domain creds). This is the artifact: mem.raw plus vol.exe on a non-DFIR system is adversarial, not investigative. - Privilege escalation chain: PE injection via zoom.txt (T1055.002), Kerberoasting via SPN query (T1134.003), then RDP lateral movement to DC using NTLM downgrade (T1021.001), all within 26 hours of first click. - Scheduled task persistence on print server masqueraded as ScheduledDefrags, running debug.log via node.exe from AppData\Roaming\node-v22.11.0-win-x64. Key detections: JS/Agent-BLXU (node.log), Troj/Ransom-HKG (Win64.exe), Troj/Ilocrypt-A (dll.dll, NtlmThief). C2: browser-updater[.]com, hxxp://216.203.20[.]36/debug[.]log. #DFIR_Radar

Top 5 Trending CVEs: 1 - CVE-2024-32002 2 - CVE-2025-20333 3 - CVE-2026-20131 4 - CVE-2026-33626 5 - CVE-2024-57726 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

Cisco FMC のゼロデイ脆弱性 CVE-2026-20131：Interlock ランサムウェアが実環境で悪用 https://iototsecnews.jp/2026/03/18/cisco-firewall-0-day-vulnerability-exploited-in-the-wild-to-deploy-interlock-ransomware/ 訳者後書：今回のインシデントにおける侵入経路は、Cisco Secure Firewall Management Center (FMC) における深刻なゼロデイ脆弱性 CVE-2026-20131 の悪用によるものです。この問題の原因は、認証を受けていないリモートの攻撃者が、最高権限である root 権限で任意の Java コードを実行できてしまうという、ソフトウェア上の不備にあります。攻撃グループが使用するインフラ・サーバの設定に不適切な箇所があったことで、彼らの高度な運用ツールキットが露出し、実態の解明へとつながりました。この脆弱性は CISA KEV にも登録され、Date Added: 2026-03-19／Due Date: 2026-03-22 という、きわめて厳しい期限が設定されています。ご利用のチームは、ご注意ください。 #Cisco #CVE202620131 #FMC #SecureFirewallManagementCenter #Vulnerability #ZeroDay