CVE-2026-20131

10.0 CRITICAL 44% exploit odds Drop everything exploited in the wild Fix listed Code execution Network gear

What it is

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

At a glance

Exploitability: Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.
In the wild: CISA lists this as exploited in real attacks. Treat as urgent.
Fix: A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

2025-10-08 11:59 UTC ReservedThe CVE id was reserved by its CNA
2026-03-04 18:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2026-03-19 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
2026-03-22 Remediation deadlineCISA's due date for federal agencies to fix it
2026-06-17 10:17 UTC Last updatedMost recent change to the record