CVE-2026-20131: Cisco FMC RCE Exploited by Interlock

Interlock ransomware operators exploited CVE-2026-20131, a maximum-severity remote code execution flaw in Cisco Secure Firewall Management Center (FMC), for more than five weeks before Cisco shipped a fix, and any FMC that ran vulnerable software after January 26 needs a compromise review as well as a patch.

CVE-2026-20131 is an insecure deserialization bug (CWE-502) in the FMC web-based management interface. It carries a CVSS score of 10.0 from Cisco and lets an unauthenticated remote attacker run arbitrary Java code as root. FMC is the console that pushes policy to an organisation’s entire fleet of Cisco firewalls, so root on that one box reaches every device it manages.

Cisco disclosed and patched the flaw on March 4, 2026. Two weeks later, Amazon threat intelligence reported that its honeypot network had recorded Interlock exploiting it since January 26. A new technical analysis from SecureLayer7 now reconstructs the attack from the public proof-of-concept and Amazon’s telemetry.

As of November 15, fixed software is available for every supported on-premises FMC branch, Cisco has already patched its hosted Security Cloud Control (SCC) Firewall Management service, and Cisco lists no workaround. The flaw lies in CISA’s Known Exploited Vulnerabilities catalog, where ransomware use is marked as known.

How the CVE-2026-20131 Attack Works

Java serialization turns an object in memory into a stream of bytes so it can be stored or sent across a network, and deserialization rebuilds the object on the other side. The FMC web interface accepts such a byte stream from the network and rebuilds it without first checking who sent it or what it contains.

That order of operations is the bug. An attacker sends an HTTP POST whose body is a serialized Java object, which always begins with the bytes AC ED 00 05. The server starts rebuilding the object, and a “gadget chain” hidden inside it, a sequence of legitimate library classes arranged so that loading them runs a command, fires before any application-level validation takes place. The FMC web services already run as root, so the command does too.

SecureLayer7 says the payloads seen in the wild match the output format of ysoserial, a public tool that generates these chains, and that Zscaler’s detection of the attacks uses a ysoserial signature. The exact FMC endpoint, the gadget chain, and Cisco’s code fix have not been published. SecureLayer7 states that it did not run the exploit and that its sequence is a reconstruction.

Cisco found CVE-2026-20131 itself during internal security testing by its Advanced Security Initiatives Group, and tracks it as bug CSCwt14636. The CVE record lists FMC releases across the 6.4 and 7.x branches up to 7.7.11, as well as 10.0.0, as affected. Secure Firewall ASA and Secure Firewall Threat Defense software are not affected.

What Interlock Did After Getting Root

Amazon’s sensors observed requests to a specific FMC path that carried Java code and two URLs. One URL delivered configuration data for the exploit. The other made the compromised FMC send an HTTP PUT containing a generated file to an attacker’s server, which then told Interlock the exploit had worked.

Amazon’s researchers answered with the PUT request the attackers expected, posing as a victim. Interlock’s server responded with an ELF binary, and the same misconfigured staging host turned out to contain the group’s entire toolkit, organized into per-target folders. Interlock “had a zero-day in their hands,” said CJ Moses, CISO of Amazon Integrated Security.

The toolkit included a PowerShell script that inventories Windows hosts, from installed software and Hyper-V machines to browser data and RDP logon events, and zips the results per host on a network share. Two remote access trojans, one in JavaScript and one in Java, provided shell access, file transfer and SOCKS5 proxying, with the JavaScript version talking to its controller over RC4-encrypted WebSockets.

A memory-resident Java web shell registered itself as a ServletRequestListener and ran AES-128-encrypted commands without writing a file to disk. A Bash script turned Linux servers into HAProxy relays that hid Interlock’s real infrastructure, and added a cron job that wiped logs every five minutes. The group also used ConnectWise ScreenConnect for backup access, Volatility to pull credentials from memory dumps and Certify to find weak Active Directory certificate templates.

Amazon tied the activity to Interlock through the ransom note, the TOR negotiation portal and a per-victim organisation identifier. Education accounted for the largest share of targets, followed by engineering and construction firms, manufacturing, healthcare and government. Timing analysis put the operators in the UTC+3 time zone with 75 to 80 percent confidence.

Is CVE-2026-20131 Still Being Exploited?

Cisco updated its advisory on March 18 to confirm exploitation in the wild, and CISA added CVE-2026-20131 to the KEV catalog on March 19 with a March 22 deadline for US federal agencies.

Zscaler ThreatLabz recorded exploit attempts from March 6, two days after disclosure, against US technology and software companies, and said the payloads contained a proof-of-concept published on GitHub. Several repositories now claim to offer scanners or exploits for the flaw, and at least one has been flagged by exploit trackers as a Trojan aimed at its downloaders.

SecureLayer7 puts the flaw’s EPSS score, an estimate of the likelihood of exploitation in the next 30 days, at 0.432 as of October 15, higher than 98.7 percent of all scored CVEs. It cites internet scans showing roughly 300 to 700 FMC management interfaces reachable from the public internet, a range taken from earlier research on a sibling flaw.

Why It Is Not the Same Bug as CVE-2026-20079

FMC has had three exploited flaws in 2026, and they are easy to confuse. CVE-2026-20079, also rated 10.0 and patched on the same day, is an authentication bypass. CVE-2026-20316, disclosed on July 29, is a hard-coded low-privilege account. Cisco Talos reported on September 9 that three separate clusters, including a Qilin ransomware affiliate and a suspected state-backed group, were exploiting those two flaws.

The Talos report does not mention CVE-2026-20131, and the indicators differ. The /var/tmp/license.tmp log entry that Cisco published in July relates to the CVE-2026-20079 and CVE-2026-20316 activity. SecureLayer7 warns against treating those indicators as evidence of exploitation of CVE-2026-20131, for which Amazon’s list remains the reference.

What Cisco FMC Admins Should Do Now

Run show version on the FMC and enter the result into the Cisco Software Checker, which returns the first fixed release for that branch. Cisco released hotfixes for the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 branches on July 29 and promised a broader hardening release in mid-September, so an FMC last updated in March is behind on the other two exploited flaws even if it is safe from this one.

Patching closes the hole but does not remove an intruder. Any FMC that ran a vulnerable release between January 26 and its patch date should be checked against Amazon’s indicators, which include the January exploit source 206.251.239[.]164 and the support domain cherryberry[.]click. Amazon notes that file hashes are of little use because Interlock changes its files for each victim.

Behaviour is a better signal. Look for outbound HTTP PUT requests from the FMC to external hosts; POST bodies to the web interface that begin with AC ED 00 05; HAProxy or fail2ban on servers that should not have them; cron jobs deleting logs every five minutes; unexplained ScreenConnect installs and listeners on TCP port 45588. Regular five-minute gaps in local logs are themselves a warning. Cisco’s Snort rules 66082 and 66083 cover the exploit traffic.

If any of that turns up, SecureLayer7 advises rotating FMC credentials and managed-device secrets, reviewing certificate enrollment in Active Directory, and opening a case with Cisco TAC. Cisco lists no workaround, though it notes that an FMC management interface with no public internet access presents a smaller attack surface. Customers on SCC Firewall Management do not need a patch, and SecureLayer7 recommends that they review administrative and configuration logs from January to March.