CVE-2026-20131: Unauthenticated RCE via Java Deserialization in Cisco FMC and Security Cloud Control

CVE ID: CVE-2026-20131 Vendor: Cisco Affected Products: Cisco Secure Firewall Management Center (FMC) Software, Cisco Security Cloud Control (SCC) Firewall Management CISA KEV Patch Deadline: March 22, 2026

Vulnerability Overview

CVE-2026-20131 is a deserialization of untrusted data vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management. An unauthenticated, remote attacker can send maliciously crafted serialized Java objects to the management interface and achieve arbitrary code execution as root on the affected appliance. No credentials are required.

The flaw resides in how the management interface processes inbound serialized objects without sufficient validation or integrity checks. Java deserialization vulnerabilities of this class allow attackers to supply a gadget chain — a sequence of existing Java classes — that the deserializer executes upon object reconstruction. When the target process runs as root, as is the case here, full system compromise is immediate upon successful exploitation.

Attack Vector and Technical Details

The attack vector is network-based and requires no authentication, placing this vulnerability in a high-severity category. The attacker sends an HTTP or HTTPS POST request containing a serialized Java payload to the FMC or SCC web management interface. The server deserializes the object without verifying its origin or integrity, executing attacker-controlled bytecode in the context of the root user.

This class of vulnerability — CWE-502 (Deserialization of Untrusted Data) — has a long history of producing critical RCE conditions in Java-based enterprise platforms. Cisco FMC and SCC are central management planes for firewall fleets, meaning a single compromised instance grants an attacker visibility and control over every firewall policy, network segment, and security rule managed by that appliance.

No CVSS score has been published at the time of this writing, but the combination of network accessibility, zero authentication requirement, and root-level code execution places this vulnerability at or near the maximum severity range.

Real-World Impact

Cisco FMC and SCC are deployed in enterprise, government, and critical infrastructure environments as the central management plane for Cisco Firepower and Secure Firewall appliances. A successful exploit gives an attacker root access to the management host and, by extension, the ability to:

  • Modify or delete firewall rules across the entire managed fleet
  • Exfiltrate network topology data, access control policies, and VPN configurations
  • Pivot from the management appliance into adjacent network segments
  • Disable or manipulate intrusion prevention and security inspection policies silently
  • Persist within the environment by implanting backdoors at the firewall management layer

Because the FMC and SCC interfaces are often accessible from administrative workstations or jump hosts rather than the open internet, the most realistic exploitation path involves an attacker who has already gained a foothold on an internal network or administrative subnet. However, organizations that expose the FMC web interface to broader network segments — a configuration error seen in practice — face direct internet-based exploitation risk.

CISA has added CVE-2026-20131 to the Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply patches by March 22, 2026. This designation reflects assessed exploitation risk and should be treated as a prioritization signal by all organizations operating affected products.

Affected Versions

Cisco has not yet published a full list of affected software versions at time of writing. Organizations should consult the Cisco Security Advisory portal directly for version-specific guidance as it becomes available. All deployments of Cisco FMC Software and Cisco SCC Firewall Management should be treated as potentially affected until Cisco confirms otherwise.

Patching and Mitigation Guidance

Immediate actions:

  1. Isolate the management interface. Restrict access to the FMC and SCC web-based management interface to authorized administrative subnets only. Use access control lists (ACLs) at the network layer to block all traffic to the management interface from non-administrative IP ranges. If the management interface is exposed to any untrusted network segment, remove that exposure immediately.

  2. Apply patches on release. Monitor the Cisco Security Advisories page for the official patch targeting CVE-2026-20131. Apply updates as soon as they are available. Federal agencies must comply with the CISA KEV deadline of March 22, 2026.

  3. Audit current access controls. Verify that FMC and SCC management interfaces are not reachable from the internet or from broad internal subnets. Confirm that only dedicated administrative workstations or jump hosts can reach these interfaces.

  4. Review access and web logs. Examine FMC and SCC access logs for POST requests to the management interface originating from unexpected sources. Look for Java deserialization error messages, stack traces referencing untrusted object classes, or serialized object patterns (byte sequences beginning with aced0005 in hex) in web server logs.

  5. Enable alerting. Configure SIEM rules to alert on anomalous access attempts to FMC or SCC management interfaces, including repeated connection failures, requests from unknown source IPs, and large POST requests to management endpoints.

  6. Inventory affected deployments. Identify all FMC and SCC instances in your environment, including cloud-hosted SCC deployments, and confirm that each is covered by the isolation and patching actions above.

Until Cisco releases a patch, network-layer isolation of the management interface is the most effective control available. Do not treat this as optional — the zero-authentication, root-level nature of this vulnerability means any accessible FMC or SCC instance on an uncontrolled network segment is at direct risk.