InfoSecBulletin Cybersecurity for mankind
Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to fix a serious flaw, CVE-2026-20131, in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22.
Cisco released a security bulletin about the flaw on March 4. They told system managers to install the security updates quickly and said there are no fixes to work around it.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
The Cisco Secure Firewall Management Center (FMC) is a main control system for important Cisco network security tools, like firewalls, application control, intrusion prevention, URL filtering, and malware protection.
“A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device,” Cisco says in the advisory.
The flaw comes from unsafe deserialization of a Java byte stream provided by the user. It can be exploited by sending a specially made Java object to the web management interface of a device that is affected.
On March 18, the vendor updated its notice to say that CVE-2026-20131 is being actively used to attack systems. Researchers at Amazon found that hackers are using this weakness in their attacks, and that the Interlock ransomware group has been taking advantage of it as a zero-day since late January.
Amazon stated that the ransomware threat actor exploited CVE-2026-20131 more than a month before the vendor published the patch.
Interlock ransomware has claimed many well-known targets since it started in late 2024. Some of these include DaVita, Kettering Health, the Texas Tech University System, and the city of Saint Paul in Minnesota.
The attacker is using the ClickFix method to get in. They are also using special remote access tools and malware like NodeSnake and Slopoly.
CISA has added CVE-2026-20131 to its Known Exploited Vulnerabilities (KEV) catalog, marking it as “known to be used in ransomware campaigns.”
Given the severity of CVE-2026-20131 and its active exploitation status since late January 2026, CISA gave Federal Civilian Executive Branch (FCEB) agencies only until this Sunday to apply the security updates or stop using the product.
CISA’s deadline matters to all groups under Binding Operational Directive (BOD) 22-01, but private companies, state and local governments, and non-FCEB organizations should still think about it and take action.
