InfoSecBulletin Cybersecurity for mankind
Cisco has put out an urgent security warning about a critical flaw in its Secure Firewall Management Center (FMC) software. This serious flaw lets hackers run any code with full control from far away. CVE-2026-20131 is a major security issue with a CVSS score of 10.0. It comes from unsafe deserialization (CWE-502) and can be used by attackers without needing permissions.
The security flaw resides in the web-based management interface of Cisco Secure FMC. The insecure deserialization of a user-supplied Java byte stream directly causes it.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
An attacker can take advantage of this problem by sending a specially made Java object to the weak web interface. If the attack works, the attacker can run any Java code on the targeted device. This lets them gain full root access to the system.
Getting root access to a main management system is very risky. It lets attackers change security measures, turn off defenses, and keep a lasting presence for more attacks in the network.
This serious flaw was first found during internal security checks by Keane O’Kelley from the Cisco Advanced Security Initiatives Group.
The situation has gotten worse. Cisco updated its notice to say that its Product Security Incident Response Team (PSIRT) learned about attempts to use this flaw in real situations in March 2026.
This attack does not need users to do anything or to log in first, which puts systems with public management interfaces in great danger.
Cisco recommends that blocking access to the FMC management interface from the public internet will greatly lessen the risk of attacks. But, this does not remove the need for timely updates.
Mitigations:
The flaw affects Cisco Secure FMC Software and the Cisco Security Cloud Control (SCC) Firewall Management platform, no matter how the devices are set up.
Cisco has said that the Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software are safe and not affected by this issue.
Cisco has already added needed security updates for the SaaS SCC Firewall Management. This means cloud customers do not need to do anything extra.
However, for on-site setups, there are no quick fixes to deal with this threat. Groups must quickly use the official security updates from Cisco.
Administrators are advised to use the Cisco Software Checker tool to check their software versions and quickly update any weak systems.
