What breaks and who needs to read this
If you run Cisco Secure Firewall Management Center (FMC) or Cisco Security Cloud Control (SCC) you are facing a critical remote‑code‑execution flaw. An unauthenticated attacker can send specially crafted data to the web‑based management interface and cause the appliance to run arbitrary Java code with root privileges.
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
The vulnerability is being exploited in the wild and has been linked to ransomware attacks. If your organisation relies on FMC or SCC for firewall policy management, you must act now.
Why this is a big deal
The CVSS score is 10.0 – the highest possible. That means the attack requires no authentication, can be launched over the network, and gives the attacker full control of the underlying operating system. With root access an attacker can install back‑doors, exfiltrate data, or encrypt the device for ransom.
Because the flaw lives in the management interface, the impact spreads to every firewall that is managed by the compromised FMC or SCC instance. In a typical deployment that could be dozens of firewalls protecting critical services.
How the vulnerability works
The NVD description tells us the problem is a deserialization of untrusted data in the web UI. In Java, deserialization turns a byte stream back into an object. If an attacker can control that stream, they can inject objects that execute code during the deserialization process. The vulnerable code does not validate the input before feeding it to the Java deserializer, so any crafted payload will be processed.
When the malicious payload reaches the vulnerable endpoint, the Java runtime instantiates classes that contain malicious logic – typically a command‑execution class. Because the deserialization runs with the privileges of the management service, the attacker ends up executing commands as the root user on the appliance.
Details of the exact endpoint, request format, and payload construction have not been published by Cisco. That is intentional – the public advisory only confirms the class of vulnerability and the fact that it has been weaponised. The exploit code is therefore only available to threat actors and to trusted partners who have signed NDAs.
How to find out if you are exposed
First, confirm you are running either Cisco Secure Firewall Management Center or Cisco Security Cloud Control. The following commands work on the appliance CLI:
show version– prints the product name and version string.show running-config | include ^hostname– confirms you are on an FMC or SCC node.
If the output mentions FMC or SCC, you are in scope.
Next, verify whether your installation is already patched. Cisco publishes a security advisory with a “patched release” for each product line. The advisory does not list version numbers here, but the official Cisco advisory page will have a table that maps your current branch to the patched release. Compare the branch shown by show version with the table. If your branch appears in the “fixed” column, you are safe; otherwise you are vulnerable.
Because the NVD has not published a list of affected versions, you must rely on Cisco’s own advisory – the table below will be populated automatically from the NVD feed. Use that table as the definitive source.
What Cisco says you must do
Cisco’s advisory, echoed by CISA, demands the following:
- Apply the vendor‑supplied mitigations or patches immediately.
- If you run the cloud‑hosted version (SCC), follow the guidance in the Federal‑Office‑for‑Cyber‑Security (BOD 22‑01) for cloud services – essentially isolate the management interface, enforce strict network ACLs, and monitor for anomalous traffic.
- If a patch is not yet available for your branch, consider taking the management interface offline or disabling remote access until a fix can be applied.
Do not postpone – the risk of ransomware infection is real and ongoing.
Step‑by‑step remediation
1. Back up your configuration
Before making any changes, export the current configuration. From the CLI:
copy running-config tftp://your‑tftp‑server/fmc‑backup.cfgOr use the GUI – navigate to System > Backup & Restore and download a full backup.
2. Download the patched release
Log in to the Cisco Software Download portal with your support contract. Search for “Secure Firewall Management Center” or “Security Cloud Control”. Locate the advisory for CVE-2026-20131 and download the “patched release” for the branch you are running. The advisory will state the exact file name – do not guess.
3. Install the patch
For an on‑premises FMC appliance, the typical upgrade flow is:
- Upload the image to the appliance via
scpor the GUI “Software Management” page. - Verify the image checksum – Cisco provides a SHA‑256 hash in the advisory.
- Run the upgrade command, for example
install software image image‑name. The command will prompt you to confirm. - Reboot when the installation completes.
For SCC (the cloud service), you cannot apply a patch yourself. Instead, open a support case with Cisco and request that the service be upgraded to the patched version. Cisco will schedule a maintenance window.
4. Verify the patch is active
After the reboot, run show version again and compare the displayed release with the “fixed” column in the table below. You should see the patched release listed.
test that the vulnerable endpoint no longer accepts malformed payloads. Cisco provides a simple verification script in the advisory – run it from a separate host and confirm it returns a “not vulnerable” status.
5. Apply mitigations if you cannot patch immediately
If, for any reason, you cannot install the patched release right now, implement the following temporary controls:
- Restrict access to the management web UI to a single trusted IP range using firewall ACLs.
- Disable remote management over the internet – only allow access from the internal network.
- Enable strong authentication (multi‑factor) for all admin accounts.
- Monitor the management interface logs for unusual POST requests or large payloads.
These steps do not eliminate the flaw but raise the bar for an attacker.
6. If no patch exists for your branch
Should the table below show that your branch has no fixed release, you have two options:
- Contact Cisco support and request an emergency patch or migration path to a supported branch.
- Take the management interface out of service – shut down the web UI, block all inbound traffic to port 443 on the appliance, and manage firewalls via the CLI until a safe version is available.
Continuing to run an unpatched appliance is unacceptable given the confirmed exploitation.
What to do after you’ve patched
Run a full vulnerability scan again – the scanner should now report the issue as resolved. Keep an eye on Cisco’s security advisory page for any follow‑up notices. Document the patch date, the backup you took, and the verification results in your change‑management system.
Finally, review your incident‑response playbook. The presence of a known‑exploited vulnerability means you should be prepared for potential compromise attempts. Ensure logs are being forwarded to a SIEM and that you have a containment procedure ready.
References
- Cisco Security Advisory – CVE-2026-20131 (official Cisco website)
- CISA Known Exploited Vulnerabilities catalog – entry for CVE-2026-20131
- Federal Office for Cyber Security – BOD 22‑01 guidance for cloud services
Table of affected and fixed releases
The table below is generated automatically from the NVD feed. It lists which product releases are known to be vulnerable and which contain the fix. Use it as the authoritative source for your upgrade decision.
Affected versions
NVD has not published machine-readable version ranges for CVE-2026-20131 yet. Check the vendor advisory for the exact affected and fixed releases before you plan an upgrade.
