Which products and versions are affected by CVE-2026-20131?

Affected: Secure Firewall Management Center (Cisco) versions 10.0.0, 6.4.0.13, 6.4.0.14, 6.4.0.15, 6.4.0.16, 6.4.0.17, 6.4.0.18, 7.0.0; Cisco Secure Firewall Management Center (FMC) versions >= 7.0.0. The full list is in the CVE brief.

Is CVE-2026-20131 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 18, 2026 and is known to be used in ransomware campaigns.

Is CVE-2026-20131 in the CISA KEV catalog?

Yes. It was added on Mar 19, 2026 with a federal remediation due date of Mar 22, 2026.

Is there a public exploit for CVE-2026-20131?

Public exploit code is available.

Is there a fix for CVE-2026-20131?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2026-20131 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2026-20131

CriticalExploitedPublic exploit

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

Published Mar 4, 2026 · Updated Aug 14, 2026

Key Facts

Patch immediately

CVE-2026-20131 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Secure Firewall Management Center (Cisco), Cisco Secure Firewall Management Center (FMC).
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 18, 2026 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 43% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

43%

Higher than 98.7% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-20131 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Mar 19, 2026	Mar 22, 2026	Known
Industry KEV feed	Mar 18, 2026	Mar 22, 2026	Known
CIRCL KEV	Mar 19, 2026	Mar 22, 2026	Known
ENISA EUVD	Mar 19, 2026	n/a	Not reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

72 affected entries in total

Product	Affected versions	Fixed in
Secure Firewall Management CenterCisco	10.0.0, 6.4.0.13, 6.4.0.14, 6.4.0.15, 6.4.0.16, 6.4.0.17, 6.4.0.18, 7.0.0	n/a
Cisco Secure Firewall Management Center (FMC)	>= 7.0.0	n/a

Timeline

Publicly disclosed
Mar 4, 2026
Added to Industry KEV feed
Mar 18, 2026
Added to CISA KEV
Mar 19, 2026
Added to CIRCL KEV
Mar 19, 2026
Added to ENISA EUVD
Mar 19, 2026
Last updated
Aug 14, 2026

Weakness Type

CWE-502 Deserialization of Untrusted Data

References

6 more references in the full CVE brief

FAQ

Common Questions.

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
Affected: Secure Firewall Management Center (Cisco) versions 10.0.0, 6.4.0.13, 6.4.0.14, 6.4.0.15, 6.4.0.16, 6.4.0.17, 6.4.0.18, 7.0.0; Cisco Secure Firewall Management Center (FMC) versions >= 7.0.0. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 18, 2026 and is known to be used in ransomware campaigns.
Yes. It was added on Mar 19, 2026 with a federal remediation due date of Mar 22, 2026.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2026-20131 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.