LiveActive security incident?Get immediate response
CVE Record

CVE-2026-20131: Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

CriticalCVSS 10Known exploitedUpdated
Discuss exposureBack to CVEs
Glexia's TakeHuman reviewedcritical

Security readout for executives and security teams

Plain-English summary

This is a critical flaw in Cisco Secure Firewall Management Center’s web management interface. A remote attacker who can reach that interface could run code on the device as root without logging in. Business urgency is highest when FMC management is exposed to the internet or broadly reachable from untrusted networks.

Executive priority

Treat as urgent for any Cisco FMC instance with reachable management access. Root-level remote code execution on a firewall management platform can create major operational and security impact. Prioritize exposure reduction immediately and schedule Cisco-guided remediation as soon as possible.

Technical view

CVE-2026-20131 is an insecure deserialization issue, CWE-502, in Cisco Secure Firewall Management Center Software. The CVSS 3.1 score is 10.0, with network attack vector, low complexity, no privileges, and no user interaction. Successful exploitation allows arbitrary Java code execution and privilege escalation to root on affected FMC devices.

Likely exposure

Exposure depends on whether the FMC web-based management interface is reachable. Public internet access materially increases risk. Internal-only management reduces attack surface but does not remove risk from compromised hosts, VPN users, partner networks, or flat internal networks.

Exploitation context

The source bundle does not show CISA KEV listing for this CVE. Cisco describes unauthenticated remote code execution via crafted serialized Java objects. An AWS security blog is referenced, but the provided bundle does not establish active exploitation details for this CVE.

Researcher notes

Evidence supports a critical unauthenticated RCE caused by Java insecure deserialization in FMC’s web management interface. The source bundle lists many affected versions but does not include fixed-version details. Avoid assuming exploitation beyond the sources; KEV status is false in the provided bundle.

Mitigation direction

  • Review Cisco’s advisory for fixed software and upgrade guidance.
  • Remove public internet access to the FMC management interface.
  • Restrict management access to trusted administrative networks only.
  • Place FMC management behind strong network controls and monitoring.
  • Prioritize affected versions listed in the CVE bundle.

Validation and detection

  • Inventory all Cisco Secure FMC deployments and software versions.
  • Confirm whether the web management interface is internet reachable.
  • Compare versions against the affected version list in the CVE bundle.
  • Check Cisco’s advisory for current fixed-release guidance.
  • Monitor CISA KEV and Cisco updates for exploitation status changes.
Prepared
Reviewed
Confidence
medium
Sources
5

Public sources used

Michael Williams reviewed this cited source version on .

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-502: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-20131 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
Yes
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CISA KEV status

Status
Known exploited
Source
CISA / ADP
Date added
Not provided

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

10Critical
CVSS 3.1 vector shape for CVE-2026-20131Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco Secure Firewall Management Center (FMC)7.0.0, 7.0.0.1, 7.0.1, 7.1.0, 6.4.0.13, 7.0.1.1, 6.4.0.14, 7.1.0.1, 7.0.2, 6.4.0.15, 7.2.0, 7.0.2.1, 7.0.3, 7.1.0.2, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 6.4.0.16, 7.3.0, 7.2.2, 7.3.1, 7.2.3, 7.1.0.3, 7.2.3.1, 7.2.4, 7.0.6, 7.2.4.1, 7.2.5, 7.3.1.1, 7.4.0, 6.4.0.17, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.4.1.1, 7.0.6.2, 6.4.0.18, 7.2.7, 7.2.5.2, 7.3.1.2, 7.2.8, 7.6.0, 7.4.2, 7.2.8.1, 7.0.6.3, 7.4.2.1, 7.2.9, 7.0.7, 7.7.0, 7.4.2.2, 7.2.10, 7.6.1, 7.4.2.3, 7.0.8, 7.6.2, 7.7.10, 7.2.10.1, 7.0.8.1, 7.6.2.1, 7.2.10.2, 7.7.10.1, 7.4.2.4, 7.4.3, 7.7.11, 7.6.4, 10.0.0, 7.4.4, 7.4.5unknown
Weakness

CWE details

CWE-502

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-502 · source CWE mapping

Deserialization of Untrusted Data

Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs