CVE-2026-20131: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

This vulnerability affects Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. It is a deserialization of untrusted data issue in the web-based management interface that permits an unauthenticated remote attacker to run arbitrary Java code with root privileges on the device.

The issue is significant because it enables complete takeover of the management system and is known to be used in ransomware campaigns.

How it works

The weakness is categorized as CWE-502, deserialization of untrusted data. An attacker supplies crafted serialized content to the web-based management interface. When the application deserializes that content without sufficient validation, it can result in execution of attacker-controlled Java code running as root.

• The attack requires no authentication and can be launched remotely against the management interface.
• Successful exploitation grants the attacker the same privileges as the root user on the affected appliance or cloud-managed instance.

Am I affected? How to find it in your systems

Inventory all deployments of Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management. Focus on instances that expose the web-based management interface to any network, including internal segments or cloud access paths. Confirm the exact software versions and configurations in use against the vendor advisory, as the vulnerability is tied to specific builds of these products.

• Check centralized management consoles, cloud control planes, and any high-availability pairs.
• Review network exposure: determine whether the management interface is reachable from untrusted networks or via VPN concentrators.
• Look for log entries or telemetry that show unexpected deserialization activity or Java process anomalies on the management host; specific indicators must be validated against vendor guidance.

How to remediate

Apply the vendor-supplied update referenced in the official advisory as the primary remediation. After patching, review and harden the management interface configuration according to the same advisory.

• Restrict access to the web management interface to only authorized administrative networks or jump hosts.
• Disable unnecessary remote management features if they are not required for operations.
• Ensure logging of management interface access is enabled and forwarded to a central SIEM for review.

If you can't patch immediately

Follow the mitigations specified in the vendor instructions. For cloud-managed instances, apply any applicable BOD 22-01 guidance. If mitigations cannot be implemented, discontinue use of the affected product until it can be updated or replaced.

• Place the management interface behind network segmentation that blocks untrusted sources.
• Consider virtual patching or web application firewall rules that inspect and drop suspicious serialized payloads targeting the management endpoints.
• Increase monitoring for authentication attempts and process execution anomalies on the management platform until the update is applied.

If your data may have been exposed

Because this vulnerability has been used in ransomware activity, organizations should assume that successful exploitation could lead to data access or further compromise. Run a free exposure scan of organizational email addresses against known breach datasets to identify any related account exposure.