Vulnerability · CVE-2026-20131

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

Published Mar 4, 2026 · catalog updated Jun 17, 2026 · Cisco Secure Firewall Management Center (FMC)

Patch now

CVE-2026-20131 is in the CISA known-exploited catalog, due Mar 22, 2026. Confirm Cisco Secure Firewall Management Center (FMC) against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity: Critical10.0
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 43.17%
Remediation: Remediation guidance
Affected products: cpe cisco/secure firewall management center · vendor Cisco Secure Firewall Management Center (FMC)

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe cisco/secure firewall management center6.4.0.13
cpe cisco/secure firewall management center6.4.0.14
cpe cisco/secure firewall management center6.4.0.15
cpe cisco/secure firewall management center6.4.0.16
cpe cisco/secure firewall management center6.4.0.17
cpe cisco/secure firewall management center6.4.0.18
cpe cisco/secure firewall management center7.0.0
cpe cisco/secure firewall management center7.0.0.1
vendor Cisco Secure Firewall Management Center (FMC)version unspecified

How to fix CVE-2026-20131

Recommended remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA due date Mar 22, 2026.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Which versions are affected?

Compare what you have installed with cisco/secure firewall management center 6.4.0.13; cisco/secure firewall management center 6.4.0.14; cisco/secure firewall management center 6.4.0.15; cisco/secure firewall management center 6.4.0.16. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What should an analyst verify?

CWE-502: Deserialization of Untrusted Data. EPSS 43.17%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Mar 4, 2026 · Catalog
Detected
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java objec
Mar 19, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 22, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java objec
Jun 17, 2026 · NIST NVD
Updated
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java objec

Sources

CISA KEVConfirmed exploitationCVE-2026-20131
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
cisa.gov
CVE.orgVulnerability recordCVE-2026-20131
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-20131
30-day exploitation probability 43.2%
first.org
NIST NVDVulnerability recordCVE-2026-20131
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserializat
nvd.nist.gov
VulnCheck KEVConfirmed exploitationCVE-2026-20131
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitr
vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

67/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability9/20
CVSS severity15/15
Public exploit0/10
Internet exposure10/10
Product prevalence3/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
10.0 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS probability
43.17% · p98.71%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Mar 18, 2026. Ransomware use: Known.
Patch availability
Remediation guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Stacks

Cisco

Weakness

CWE-502
Deserialization of Untrusted Data
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.