Critical Cisco FMC Flaw Exploited by Interlock Ransomware for Root Access

A critical vulnerability in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131, has been actively exploited by the Interlock ransomware group, allowing attackers to execute arbitrary Java code as root on affected devices. This flaw, which carries a CVSS score of 10, was disclosed on March 4, 2026, and has since been added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to its exploitation in the wild. The vulnerability arises from insecure deserialization in the web-based management interface of Cisco FMC software. This flaw enables unauthenticated, remote attackers to gain root access, posing a severe risk to organizations using this firewall management solution. The exploitation of this vulnerability was notably swift, with attackers leveraging it within 13 days of its disclosure. Interlock ransomware actors have been identified as the primary exploiters of CVE-2026-20131. They reportedly began exploiting the flaw 36 days before its public disclosure, indicating a significant lead time in their attack strategy. The group utilized this vulnerability to gain unauthorized access and deploy ransomware, causing substantial disruption to targeted networks. The exploitation of CVE-2026-20131 has been facilitated by the availability of multiple proof-of-concept (PoC) exploits, with at least four known PoCs circulating in the cybersecurity community. This has likely contributed to the rapid adoption of the exploit by malicious actors, further emphasizing the critical nature of the vulnerability. Cisco has responded by urging users to apply patches immediately to mitigate the risk posed by this vulnerability. The company has released updates to address the flaw, and organizations are strongly advised to prioritize these updates to protect their systems from potential exploitation. Given the critical severity of CVE-2026-20131 and its active exploitation by ransomware groups, security teams should conduct thorough assessments of their Cisco FMC deployments. This includes verifying the application of patches and monitoring for any signs of compromise. Additionally, organizations should review their incident response plans to ensure they are prepared to address potential breaches resulting from this vulnerability. The exploitation of CVE-2026-20131 highlights the ongoing threat posed by ransomware groups and the importance of timely patch management. As attackers continue to exploit vulnerabilities shortly after disclosure, maintaining a proactive security posture is essential to safeguarding critical infrastructure.