InfoSecBulletin Cybersecurity for mankind
Cisco has put out an urgent security warning about a critical flaw in its Secure Firewall Management Center (FMC) software. This serious flaw lets hackers run any code with full control from far away. CVE-2026-20131 is a major security issue with a CVSS score of 10.0. It comes from unsafe deserialization (CWE-502) and can be used by attackers without needing permissions.
The security flaw resides in the web-based management interface of Cisco Secure FMC. The insecure deserialization of a user-supplied Java byte stream directly causes it.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
An attacker can take advantage of this problem by sending a specially made Java object to the weak web interface. If the attack works, the attacker can run any Java code on the targeted device. This lets them gain full root access to the system.
Getting root access to a main management system is very risky. It lets attackers change security measures, turn off defenses, and keep a lasting presence for more attacks in the network.
This serious flaw was first found during internal security checks by Keane O’Kelley from the Cisco Advanced Security Initiatives Group.
The situation has gotten worse. Cisco updated its notice to say that its Product Security Incident Response Team (PSIRT) learned about attempts to use this flaw in real situations in March 2026.
This attack does not need users to do anything or to log in first, which puts systems with public management interfaces in great danger.
Cisco recommends that blocking access to the FMC management interface from the public internet will greatly lessen the risk of attacks. But, this does not remove the need for timely updates.
Mitigations:
The flaw affects Cisco Secure FMC Software and the Cisco Security Cloud Control (SCC) Firewall Management platform, no matter how the devices are set up.
Cisco has said that the Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software are safe and not affected by this issue.
Cisco has already added needed security updates for the SaaS SCC Firewall Management. This means cloud customers do not need to do anything extra.
However, for on-site setups, there are no quick fixes to deal with this threat. Groups must quickly use the official security updates from Cisco.
Administrators are advised to use the Cisco Software Checker tool to check their software versions and quickly update any weak systems.
