# CVE-2026-20131: Cisco Secure Firewall Management Center deserialization RCE

Source: https://junglewise.ai/threats/cve-2026-20131-cisco-secure-firewall-management-center-deserialization-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-20131 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-03-19

Cisco Secure Firewall Management Center (FMC) is a centralized administrative hub used to manage and configure network security policies across an organization's firewalls. A critical security flaw has been identified that allows an unauthorized person to take complete control of this management system over the internet. If exploited, an attacker could gain full administrative access (root), potentially allowing them to disable security protections, intercept data, or launch further attacks within the corporate network. This vulnerability is currently being exploited in the wild by ransomware groups.

Technologies: [Cisco Secure Firewall Management Center (FMC)](https://junglewise.ai/threats/technologies/secure-firewall-management-center-fmc), [Cisco Secure Firewall Management Center](https://junglewise.ai/threats/technologies/secure-firewall-management-center). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20131 exploited in the wild?** Yes. CVE-2026-20131 is known to be exploited in the wild, first recorded on 19 March 2026. Treat it as urgent.

**How severe is CVE-2026-20131?** Critical severity, with a CVSS score of 10, published 19 March 2026.

**Which products and versions are affected?** Cisco Secure Firewall Management Center 7.2.4.1, 7.2.5, 7.2.5.1, 7.2.5.2.

**Is there a fix for CVE-2026-20131?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20131 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20131?** Check whether you run Cisco Secure Firewall Management Center (FMC), Cisco Secure Firewall Management Center or Cisco Security Cloud Control at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in the web-based management interface of Cisco FMC and SCC. The flaw stems from the insecure processing of user-supplied Java byte streams. An unauthenticated remote attacker can exploit this by sending a specially crafted serialized Java object to the management interface. Successful exploitation results in arbitrary Java code execution with root privileges on the underlying operating system. This vulnerability has been observed in active exploitation by threat actors, including those associated with ransomware campaigns. Organizations are advised to restrict management interface access to trusted internal networks and apply vendor-provided patches immediately.

## Affected products

- Cisco Secure Firewall Management Center (FMC) 7.2.4.1, 7.2.5, 7.2.5.1, 7.2.5.2
- Cisco Security Cloud Control (SCC) Firewall Management

## Timeline

- 2026-03-19: disclosed
- 2026-03-19: advisory
- 2026-03-19: kev added: Added to CISA Known Exploited Vulnerabilities catalog.
- 2026-03-19: exploited

## Related threats

- [Cisco Secure FMC SSO token forgery in ASDM handler](https://junglewise.ai/threats/cve-2026-76413-cisco-secure-fmc-sso-token-forgery-in-asdm-handler)
- [Cisco Secure FMC privilege escalation in remote diagnostics debugger](https://junglewise.ai/threats/cve-2026-76412-cisco-secure-fmc-privilege-escalation-in-remote-diagnostics)
- [Cisco Secure Firewall software resource lifecycle vulnerability](https://junglewise.ai/threats/cve-2026-20336-cisco-secure-firewall-software-resource-lifecycle-vulnerability)
- [Cisco Secure FMC and FTD sftunnel authentication bypass](https://junglewise.ai/threats/cve-2026-20323-cisco-secure-fmc-and-ftd-sftunnel-authentication-bypass)
- [Cisco Secure FMC and FTD memory exhaustion in sftunnel](https://junglewise.ai/threats/cve-2026-20295-cisco-secure-fmc-and-ftd-memory-exhaustion-in-sftunnel)