CVE-2026-20131Vulnerability
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Zscaler ThreatLabz · last reported
Last reported 2 months ago
CISA KEVAdded 19 Mar 2026
Fix due 22 Mar 2026
Used by ransomware: knownCISA KEV catalogue
Fix due 22 Mar 2026
Used by ransomware: knownCISA KEV catalogue
EPSS43.2%
higher than 98% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 98% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
2608-volatility-interlock“More recently, Interlock has been actively exploiting CVE-2026-20131, a critical-severity zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) Software.”
-
Critical Remote Code Execution Vulnerability in Cisco Secure Firewall Management Center (CVE-2026-20131)“Critical Remote Code Execution Vulnerability in Cisco Secure Firewall Management Center (CVE-2026-20131)”
Indicators reported together
named in the same reports- www.redacted[.]comin 1 report
- 64.95.11[.]22in 1 report
- voginc[.]comin 1 report
- afshapiro[.]comin 1 report
- 104.236.109[.]139in 1 report
- browser-updater[.]comin 1 report
- hxxp://216.203.20[.]36/debug.login 1 report
- 216.203.20[.]36in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.