Cisco FMC: CVE-2026-20131: Insecure Deserialization Remote Code Execution

A critical insecure deserialization vulnerability exists in the web-based management interface of Cisco Secure Firewall Management Center (FMC). The application fails to properly validate and securely deserialize user-supplied Java byte streams. An unauthenticated, remote attacker can exploit this by sending a crafted serialized Java object to the affected management interface.

Successful exploitation allows the attacker to execute arbitrary Java code with "root" privileges on the underlying operating system, leading to complete system compromise. This flaw has been actively exploited in the wild by ransomware actors (such as Interlock).

Affected Versions: Select Cisco FMC releases including 6.4.x, 7.0.x, 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x, and 10.0.0.
Required Configuration: Any Cisco FMC instance with an exposed web-based management interface.