Cisco Vulnerability CVE-2026-20131 Exploited by Interlock

THE THREAT

On March 18th, 2026, Amazon reported that the Interlock ransomware group has been exploiting the maximum severity vulnerability, CVE-2026-20131 (CVSS: 10), in Cisco Secure Firewall Management Center (FMC) software, since January 2026.

The eSentire Threat Intelligence team published a security advisory addressing CVE-2026-20131 on March 4th and assessed that exploitation was likely in the near term. As exploitation of the flaw is now confirmed, organizations are recommended to apply the relevant security patches immediately.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) has plugin in place to identify devices vulnerable to CVE-2026-20131
• eSentire MDR for Network has detections in place to identify Command-and-Control (C2) and data exfiltration activity related to Interlock ransomware and Interlock RAT
• eSentire MDR for Endpoint has detections in place to identify activity related to ScreenConnect Remote Monitoring and Management (RMM) tool and usage of Certify
• The eSentire product suite includes a variety of detections for common ransomware behaviors and precursors
• Known malicious infrastructure has been added to the eSentire Global Block List
• The eSentire Threat Response Unit (TRU) is performing threat hunts for activity related to exploitation
• eSentire’s TRU is actively tracking this incident for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by Cisco
• Organizations are recommended to restrict FMC management interface access to trusted internal networks and reduce exposure to the public Internet
• Ensure only authorized software are installed on assets to prevent deployment of unauthorized tools such as rogue RMM tools

Additional information

Disclosed on March 4th, CVE-2026-20131, is a Remote Code Execution vulnerability impacting Cisco Secure Firewall Management Center (FMC) software. It is due to insecure deserialization of a user-supplied Java byte stream on the web-based management interface of Cisco Secure FMC. The vulnerability allows an unauthenticated remote attacker to execute arbitrary Java code with root-privileges on an affected device. Amazon reported that the exploitation began on January 26th. Further investigation revealed involvement of Interlock ransomware group.

In observed attacks, threat actors sent malicious HTTP requests to a specific path on the affected devices. The requests comprised Java execution commands and embedded URLs: one used to deliver exploit configuration data while another uploaded a file to a remote server after successful exploitation. The file upload led to download and execution of an ELF binary on the impacted host.

Reviewing the binary, Amazon attributed the attack to the Interlock ransomware group. The server hosting the binary was used to distribute malware belonging to the Interlock family. The server revealed a list of malware/tools leveraged by Interlock including a PowerShell tool for Windows enumeration and a bash script to set up reverse proxies. Custom Remote Access Trojans (RATs) and a backdoor used for remote persistent access and C2, and a connectivity verification tool were also observed. The group also abused legitimate tools such as ScreenConnect RMM, Volatility, an open-source memory forensics tool, and Certify, an offensive security tool.

Ongoing exploitation of CVE-2026-20131 by the Interlock ransomware group is concerning, as activity began 36 days before disclosure, allowing them to operate undetected. As the Interlock group performs double-extortion, organizations using vulnerable Cisco Secure FMC instances are at high risk of ransomware deployment and data extortion. For details on Interlock Tactics, Techniques, and Procedures (TTPs), see the TRU Positive blog post: “Unmasking Interlock Group's Evolving Malware Arsenal.” Given the severe consequences of exploitation, organizations are recommended to upgrade to a secure version immediately.

References:

[1] https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/ 
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-20131 
[3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh 
[4] https://www.esentire.com/security-advisories/maximum-severity-cisco-firewall-vulnerabilities-disclosed-cve-2026-20079-cve-2026-20131 
[5] https://www.esentire.com/blog/unmasking-interlock-groups-evolving-malware-arsenal