InfoSecBulletin Cybersecurity for mankind
Cisco has put out an urgent security warning about a critical flaw in its Secure Firewall Management Center (FMC) software. This serious flaw lets hackers run any code with full control from far away. CVE-2026-20131 is a major security issue with a CVSS score of 10.0. It comes from unsafe deserialization (CWE-502) and can be used by attackers without needing permissions.
The security flaw resides in the web-based management interface of Cisco Secure FMC. The insecure deserialization of a user-supplied Java byte stream directly causes it.
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
An attacker can take advantage of this problem by sending a specially made Java object to the weak web interface. If the attack works, the attacker can run any Java code on the targeted device. This lets them gain full root access to the system.
Getting root access to a main management system is very risky. It lets attackers change security measures, turn off defenses, and keep a lasting presence for more attacks in the network.
This serious flaw was first found during internal security checks by Keane O’Kelley from the Cisco Advanced Security Initiatives Group.
The situation has gotten worse. Cisco updated its notice to say that its Product Security Incident Response Team (PSIRT) learned about attempts to use this flaw in real situations in March 2026.
This attack does not need users to do anything or to log in first, which puts systems with public management interfaces in great danger.
Cisco recommends that blocking access to the FMC management interface from the public internet will greatly lessen the risk of attacks. But, this does not remove the need for timely updates.
Mitigations:
The flaw affects Cisco Secure FMC Software and the Cisco Security Cloud Control (SCC) Firewall Management platform, no matter how the devices are set up.
Cisco has said that the Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software are safe and not affected by this issue.
Cisco has already added needed security updates for the SaaS SCC Firewall Management. This means cloud customers do not need to do anything extra.
However, for on-site setups, there are no quick fixes to deal with this threat. Groups must quickly use the official security updates from Cisco.
Administrators are advised to use the Cisco Software Checker tool to check their software versions and quickly update any weak systems.
