VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 05:36 UTC
← Dashboard

CVE-2026-20131

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization…

Read full description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.7/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 44.43%: +0.22

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 26 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Forkast News
Press · 07 Oct 2026, 07:00 · Cisco Firewall Management Center Has Two CVSS 10.0 Unauthenticated RCEs — Interlock Ransomware Exploited One as Zero-Day - Forkast News
Recorded Future
Press · 13 Apr 2026, 07:00 · March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Day - Recorded Future
BleepingComputer
Press · 02 Apr 2026, 07:00 · Critical Cisco IMC auth bypass gives attackers Admin access - BleepingComputer
Security Affairs
Press · 02 Apr 2026, 07:00 · Cisco fixed critical and high-severity flaws - Security Affairs
Acronis
Press · 23 Mar 2026, 07:00 · MSP cybersecurity news digest, March 23, 2026 - Acronis
See all 26 source documents
Help Net Security
Press · 20 Mar 2026, 07:00 · Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) - Help Net Security
BleepingComputer
Press · 20 Mar 2026, 07:00 · CISA orders feds to patch max-severity Cisco flaw by Sunday - BleepingComputer
Security Affairs
Press · 19 Mar 2026, 07:00 · Interlock group exploiting the CISCO FMC flaw CVE-2026-20131 36 days before disclosure - Security Affairs
CSO Online
Press · 19 Mar 2026, 07:00 · Ransomware group exploited Cisco firewall vulnerability as a zero day, weeks before a patch appeared - CSO Online
The Record from Recorded Future News
Press · 19 Mar 2026, 07:00 · Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon - The Record from Recorded Future News
The Hacker News
Press · 19 Mar 2026, 07:00 · CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks - The Hacker News
SecurityWeek
Press · 19 Mar 2026, 07:00 · Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks - SecurityWeek
CyberSecurityNews
Press · 18 Mar 2026, 07:00 · Cisco Firewall 0-day Vulnerability Exploited in the Wild to Deploy Interlock Ransomware - CyberSecurityNews
BleepingComputer
Press · 18 Mar 2026, 07:00 · Ransomware gang exploits Cisco flaw in zero-day attacks since January - BleepingComputer
Amazon Web Services (AWS)
Press · 18 Mar 2026, 07:00 · Amazon threat intelligence teams identify Interlock ransomware campaign targeting enterprise firewalls - Amazon Web Services (AWS)
CyberScoop
Press · 18 Mar 2026, 07:00 · Cisco’s latest vulnerability spree has a more troubling pattern underneath - CyberScoop
The Hacker News
Press · 18 Mar 2026, 07:00 · Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access - The Hacker News
SDxCentral
Press · 05 Mar 2026, 08:00 · Cisco rushes to patch critical ‘root access’ flaws in Secure Firewall Management Center - SDxCentral
The Hacker News
Press · 05 Mar 2026, 08:00 · Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities - The Hacker News
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 05 Mar 2026, 08:00 · Cisco Products Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre
CyberScoop
Press · 05 Mar 2026, 08:00 · Cisco reveals 2 max-severity defects in firewall management software - CyberScoop
SecurityWeek
Press · 05 Mar 2026, 08:00 · Cisco Patches Critical Vulnerabilities in Enterprise Networking Products - SecurityWeek
csoonline.com
Press · 05 Mar 2026, 08:00 · Cisco issues emergency patches for critical firewall vulnerabilities - csoonline.com
Security Affairs
Press · 04 Mar 2026, 08:00 · Cisco fixes maximum-severity Secure FMC bugs threatening firewall security - Security Affairs
BleepingComputer
Press · 04 Mar 2026, 08:00 · Cisco warns of max severity Secure FMC flaws giving root access - BleepingComputer
Arctic Wolf
Press · 04 Mar 2026, 08:00 · Recommendation for CVE-2026-20079 & CVE-2026-20131 - Arctic Wolf

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.8Reality 8.707 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.0Reality 8.7Nov 2Nov 7

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

3

Public exploit entries / repo candidates

See 3 repos with metrics
RepositoryStarsForksLanguageUpdated
Hassan-Pouladi/Cisco-FMC-honeypot21Python03 Jul 2026, 22:17
basesixtythree/B63-POC-CVE-2026-2013100Python26 Oct 2026, 05:19
p3Nt3st3r-sTAr/CVE-2026-20131-POC03Python18 Mar 2026, 00:51
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 10; EPSS 44.4%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-07 20:42:52.177932+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
04 Mar 2026, 08:00
Published
04 Mar 2026, 17:17
Added to the CISA KEV catalog
19 Mar 2026, 00:00
Latest press mention
07 Oct 2026, 07:00
Score calculated
07 Nov 2026, 20:42
PoCs on GitHub
3 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar