CVE-2026-20131 -- CVSS 10.0 Vulnerability Briefing

CVE-2026-20131 | CVSS 10.0 (Critical) | Exploit: PoC available

What Is It

CVE-2026-20131 is a critical unauthenticated remote code execution vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, caused by insecure Java deserialization of attacker-supplied input.

Technical Detail

The flaw exists because the FMC web management interface deserializes user-supplied Java byte streams without adequate validation or integrity checks. A remote, unauthenticated attacker can exploit this by sending a crafted serialized Java object to the interface, triggering arbitrary Java code execution. Successful exploitation results in full root-level code execution on the affected device, representing complete system compromise of the firewall management platform.

Exploitation Status

A proof-of-concept exploit is publicly available. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed evidence of active in-the-wild exploitation at this time. However, the combination of a CVSS 10.0 score, unauthenticated attack vector, and available PoC significantly elevates the risk of exploitation in the near term.

Who Is Targeting This

No specific threat actor attribution at this time. No confirmed or reported threat actor activity has been associated with this vulnerability as of May 31, 2026.

What To Do

Apply Cisco's patch for affected Secure Firewall Management Center Software versions immediately. Given the CVSS 10.0 rating, unauthenticated attack vector, and public PoC availability, this should be treated as a priority-one remediation. As an interim measure, restrict network access to the FMC web management interface to trusted administrative hosts only, using access control lists or out-of-band management networks. The FMC management interface should never be exposed to untrusted or internet-facing networks. Monitor FMC logs for unexpected deserialization activity, anomalous Java process spawning, or unusual outbound connections from the management host. Consult Cisco's security advisory for the specific fixed software releases applicable to your deployment.