CISA orders feds to patch max-severity Cisco flaw by Sunday

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability, CVE-2026-20131, in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22. Cisco published a security bulletin about the flaw on March 4, urging system administrators to apply the security updates as soon as possible and warning that no workarounds are available. The Cisco Secure Firewall Management Center (FMC) is a centralized administration system for critical Cisco network security appliances, such as firewalls, application control, intrusion prevention, URL filtering, and malware protection. “A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device,” Cisco says in the advisory. The issue is caused by insecure deserialization of a user-supplied Java byte stream and is exploitable by sending a specially crafted serialized Java object to the web-based management interface of an affected device. On March 18, the vendor updated its bulletin to warn of active exploitation of CVE-2026-20131 in the wild. Amazon threat intelligence researchers confirmed that threat actors are leveraging the vulnerability in attacks, noting that the Interlock ransomware gang had been exploiting it as a zero-day since the end of January. Amazon stated that the ransomware threat actor exploited CV...