Vulnerability details
| CVE | Description | CVSS | KEV added |
|---|---|---|---|
| CVE-2026-20131 | Cisco Secure FMC insecure Java deserialisation, unauthenticated code execution as root | 10.0 | 19 Mar 2026 |
What happened
This is a recap of events from March 2026. Cisco disclosed and patched CVE-2026-20131 on 4 March 2026, a maximum-severity flaw in the web-based management interface of Cisco Secure Firewall Management Center (FMC) software. Cisco warned that it "could allow unauthenticated attackers to remotely execute arbitrary Java code as root on unpatched devices". At disclosure, Cisco said it had no evidence of exploitation.
On 18 March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had been exploiting the flaw against enterprise firewalls since 26 January 2026: "Interlock was exploiting this vulnerability 36 days before its public disclosure." Cisco updated its advisory the same day to acknowledge active exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 19 March 2026, with a 22 March due date for federal civilian agencies.
What Amazon observed
According to Help Net Security, Amazon's research drew on its MadPot honeypot sensors and on a server that acted as a hub for the attackers' tools. The tooling it described included:
- a PowerShell script for enumerating and collecting information on Windows hosts;
- a JavaScript remote access trojan that collects host information;
- a Java implant providing redundant command and control;
- a Bash script that turns a compromised Linux server into a temporary traffic relay;
- a memory-resident web shell and a lightweight network beacon.
The attackers also used legitimate tools: ConnectWise ScreenConnect, Volatility and Certify. FortiGuard Labs summarises the activity as fileless implants, custom malware and remote access tooling, with reconnaissance and collection of system, credential and network data before ransomware deployment.
About Interlock
Interlock emerged in September 2024. Sophos tracks it as GOLD EMBRACE and describes a small, dedicated team that builds its own malware rather than a ransomware-as-a-service operation. Sophos says the group currently focuses on North American and European targets in critical infrastructure, healthcare and education, uses double extortion, and leaks stolen data on its "Worldwide Secrets Blog". Its wider toolset, per Sophos, includes a custom remote access trojan known as NodeSnake or Interlock RAT, a PHP-based backdoor, and ClickFix-style social engineering. The sources do not say these specific tools were deployed through the FMC exploit.
What to do
- Apply Cisco's fix for CVE-2026-20131 on every FMC instance (advisory cisco-sa-fmc-rce-NKhnULJh).
- Keep the FMC management interface off the public internet; Cisco notes this reduces the attack surface.
- Check logs for the indicators of compromise Amazon published, and treat any FMC that was exposed and unpatched between late January and patching as potentially compromised.
Key points
- CVE-2026-20131 is a CVSS 10.0 insecure deserialisation flaw in the Cisco Secure FMC web interface that allows unauthenticated code execution as root.
- Amazon says Interlock exploited it from 26 January 2026, 36 days before Cisco's 4 March disclosure.
- CISA added it to KEV on 19 March 2026, with a 22 March due date.
- Amazon observed custom scripts, a JavaScript RAT, a Java implant and a memory-resident web shell, alongside ScreenConnect, Volatility and Certify.
- Interlock (GOLD EMBRACE) has been active since September 2024 and runs double-extortion attacks.
Further reading & sources
- Interlock ransomware exploited Secure FMC flaw in zero-day attacks since January (BleepingComputer)
- Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) (Help Net Security)
- Interlock Ransomware Attack | Outbreak Alert (FortiGuard Labs)
- Interlock ransomware gang creates volatile situation (Sophos)