InfoSecBulletin Cybersecurity for mankind
Cisco has put out an urgent security warning about a critical flaw in its Secure Firewall Management Center (FMC) software. This serious flaw lets hackers run any code with full control from far away. CVE-2026-20131 is a major security issue with a CVSS score of 10.0. It comes from unsafe deserialization (CWE-502) and can be used by attackers without needing permissions.
The security flaw resides in the web-based management interface of Cisco Secure FMC. The insecure deserialization of a user-supplied Java byte stream directly causes it.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
An attacker can take advantage of this problem by sending a specially made Java object to the weak web interface. If the attack works, the attacker can run any Java code on the targeted device. This lets them gain full root access to the system.
Getting root access to a main management system is very risky. It lets attackers change security measures, turn off defenses, and keep a lasting presence for more attacks in the network.
This serious flaw was first found during internal security checks by Keane O’Kelley from the Cisco Advanced Security Initiatives Group.
The situation has gotten worse. Cisco updated its notice to say that its Product Security Incident Response Team (PSIRT) learned about attempts to use this flaw in real situations in March 2026.
This attack does not need users to do anything or to log in first, which puts systems with public management interfaces in great danger.
Cisco recommends that blocking access to the FMC management interface from the public internet will greatly lessen the risk of attacks. But, this does not remove the need for timely updates.
Mitigations:
The flaw affects Cisco Secure FMC Software and the Cisco Security Cloud Control (SCC) Firewall Management platform, no matter how the devices are set up.
Cisco has said that the Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software are safe and not affected by this issue.
Cisco has already added needed security updates for the SaaS SCC Firewall Management. This means cloud customers do not need to do anything extra.
However, for on-site setups, there are no quick fixes to deal with this threat. Groups must quickly use the official security updates from Cisco.
Administrators are advised to use the Cisco Software Checker tool to check their software versions and quickly update any weak systems.
