Is CVE-2026-20131 being actively exploited?

Yes. CVE-2026-20131 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 19, 2026.

What is the CVSS score for CVE-2026-20131?

CVE-2026-20131 has a CVSS 3.1 base score of 10.0 (CRITICAL).

CVE-2026-20131

CRITICAL · CVSS 10.0CISA KEV: actively exploitedEPSS 43.2%EU EUVD: exploited

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Key facts

CVSS score: 10.0 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-502
EPSS score: 43.2% (99th percentile)
In CISA KEV: Yes, added March 19, 2026
In EU EUVD: Yes (EUVD-2026-9444)
Published: March 4, 2026
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Added to the KEV catalog on March 19, 2026; federal remediation due March 22, 2026. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-9444 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 14, 2026.

View on the EU Vulnerability Database

Affected products

cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center
cisco / secure firewall management center

and 21 more…

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Cisco Secure Firewall Threat Defense (FTD) 7.4 with Secure Firewall Management Center (FMC) 7.4 and Secure Client 5.1 - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400046-01-CR - active

References

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/(Technical Description)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain