Vulnerabilitycritical

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)

Help Net Securityby @zeljkazorzMar 20, 2026 · 00:00 UTC (Mar 20, 2026)3 min read2 · 1 read

Read at helpnetsecurity.com

Analyze CVE-2026-20131 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-20131 CVE-2026-20127 CVE-2026-20045 CVE-2025-20393

Tags: cve-2025-20393 cve-2026-20045 cve-2026-20127 cve-2026-20131 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-20393	Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands	10.0	32%	KEV	Dec 17, 2025 KEV Dec 17, 2025
CVE-2026-20045	Unauthenticated RCE to root in Cisco Unified Communications products	9.8	5%	KEV	Jan 21, 2026 KEV Jan 21, 2026
CVE-2026-20127	Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator	10.0	89%	KEV	Feb 25, 2026 KEV Feb 25, 2026
CVE-2026-20131	Unauthenticated Java Deserialization RCE in Cisco FMC and SCC	10.0	43%	KEVRansomwarePoC	Mar 4, 2026 KEV Mar 19, 2026

From the original article

3 min read at helpnetsecurity.com

A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.