CVE-2026-20131

The vulnerability results from unsafe deserialization of a Java byte stream supplied by the user (CWE-502). The attacker sends a crafted, serialized Java object to the management web interface of the vulnerable device. The lack of authentication required to perform the attack and the absence of network restrictions (if the interface is accessible from the internet) make exploitation exceptionally simple. Successful exploitation of the vulnerability leads to arbitrary code execution and privilege escalation to root level.

Attackers gain full control of the device with root privileges, enabling execution of arbitrary commands, theft of configuration data, modification of firewall security policies, and potential lateral movement in the victim's network.

Patches available from the vendor must be applied immediately in accordance with the official Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh). As an interim measure to reduce attack surface, ensure that the FMC management interface is not accessible from the public internet — according to the vendor's recommendation, this limits exploitation risk.

Cisco Secure Firewall Management Center (FMC) Software — specific versions indicated in vendor references (Cisco Security Advisory cisco-sa-fmc-rce-NKhnULJh)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.