CVE-2026-20131: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Other sources
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20131?
CVE-2026-20131 has a maximum severity rating due to its potential to allow remote code execution as root.
How do I fix CVE-2026-20131?
To mitigate CVE-2026-20131, it is recommended to apply the latest security patches provided by Cisco for the Secure Firewall Management Center.
Who is affected by CVE-2026-20131?
CVE-2026-20131 affects users of Cisco Secure Firewall Management Center Software.
Can CVE-2026-20131 be exploited remotely?
Yes, CVE-2026-20131 can be exploited by unauthenticated remote attackers.
What impact does CVE-2026-20131 have on affected devices?
CVE-2026-20131 allows attackers to execute arbitrary Java code with root privileges on affected Cisco devices.