Cisco Secure Firewall Vulnerability Exposes Systems to Remote Code Execution by Attackers

Cisco has released critical security updates to address a maximum-severity vulnerability affecting its Secure Firewall Management Center (FMC) Software.

Tracked under the identifier CVE-2026-20131, this flaw carries a perfect CVSS base score of 10.0 and allows unauthenticated, remote attackers to execute arbitrary code.

The situation is particularly urgent as the company has confirmed that threat actors are actively attempting to exploit this vulnerability in the wild as of March 2026.

Vulnerability Details and Attack Vectors

The vulnerability, categorised as CWE-502, originates in the web-based management interface of the Cisco Secure FMC Software.

The root cause is the insecure deserialization of a user-supplied Java byte stream. A remote attacker can exploit this critical weakness by sending a specially crafted serialized Java object directly to the targeted management interface.

Because this requires no prior authentication or user interaction, the attack can be executed entirely automatically over the network.

Upon successful exploitation, the attacker gains the ability to execute arbitrary Java code on the underlying operating system.

This execution occurs with full root-level privileges, effectively granting the attacker complete and unrestricted control over the compromised firewall management system.

Keane O’Kelley from the Cisco Advanced Security Initiatives Group originally discovered this flaw during internal security testing.

Exposing the FMC management interface to the public internet significantly increases the attack surface, making isolated management networks highly recommended to reduce immediate risk.

This security flaw specifically impacts on-premises Cisco Secure FMC Software deployments and the SaaS-based Cisco Security Cloud Control (SCC) Firewall Management platforms.

All device configurations are affected if they are running the vulnerable software versions, making the scope of the vulnerability unusually broad.

However, Cisco has explicitly confirmed that the Secure Firewall Adaptive Security Appliance (ASA) Software and the Secure Firewall Threat Defense (FTD) Software remain unaffected by this specific defect.

Software Remediation and Updates

There are currently no functional workarounds or temporary mitigations available to address this vulnerability.

Consequently, Cisco strongly urges all affected organizations to upgrade to the fixed software releases immediately to prevent potential network breaches.

For users relying on the SaaS-delivered Cisco SCC Firewall Management, the company has already deployed the necessary hotfixes as part of their routine maintenance cycle, meaning no additional user action is required for those environments.

Administrators managing traditional on-premises FMC deployments must manually apply the updates.

They should utilize the official Cisco Software Checker to determine their exact exposure and identify the appropriate first fixed release for their specific hardware and software combinations.

Customers who purchased equipment through third-party vendors or currently lack direct service contracts can still obtain these critical security upgrades free of charge by contacting the Cisco Technical Assistance Center.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.