Unauthenticated Java Deserialization RCE in Cisco FMC and SCC
CISA: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
CVSS 3.1
10.0critical
EPSS
33%p98
Published
()
KEV added
AI analysis
CVE-2026-20131 is a deserialization of untrusted data flaw (CWE-502) in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. An unauthenticated, remote attacker can trigger it by sending crafted serialized data to the exposed management interface. Successful exploitation allows the attacker to execute arbitrary Java code as root on the affected device, giving full control of the central platform that manages Cisco firewall policy. Any organization running FMC or managing firewalls through SCC is potentially affected; specific version ranges have not yet been published in the available data. The flaw was added to CISA KEV on 2026-03-19 with known ransomware use, and EPSS assigns a ~31% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known.
What to do: Check Cisco's advisory for fixed releases and upgrade all FMC and SCC-managed deployments as soon as patched versions are identified, since version ranges are not yet in this data; until patched, restrict the FMC/SCC web-based management interface to trusted management networks or VPN access. Given the CISA KEV listing (added 2026-03-19) with known ransomware use, treat this as a high-priority patch and confirm whether BOD 22-01 remediation deadlines apply to your organization.
Affected
Cisco Secure Firewall Management Center (FMC) Software
version ranges not yet published in available data
Cisco Security Cloud Control (SCC) Firewall Management
version ranges not yet published in available data
Estimated exposure
largetens of thousands of FMC/SCC management deployments (10k–100k systems), with a smaller subset of management interfaces internet-exposed — Cisco Secure Firewall is one of the largest enterprise firewall installed bases and FMC is its standard centralized manager, implying a five-figure number of FMC deployments, though only management interfaces reachable by untrusted…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
CISA Known Exploited Vulnerability
Affected
Cisco Secure Firewall Management Center (FMC)
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Cisco and CISA warn that critical FMC authentication bypass CVE-2026-20079 is actively exploited; CISA added it to the KEV catalog with a September 12 deadline.
Cisco and CISA flagged active exploitation of CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center allowing remote, unauthenticated attackers to run malicious scripts and gain root access via crafted HTTP requests. Cisco patched the flaw in early March and added IoCs in late July, but confirmed active exploitation in its September 9 advisory; CISA added it to the KEV catalog requiring federal remediation by September 12. Talos identified three activity clusters exploiting CVE-2026-20079 and CVE-2026-20316, including state-sponsored and financially motivated actors, and this is the third FMC vulnerability in KEV this year after CVE-2026-20316 and CVE-2026-20131.
CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.
The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.