Interlock Ransomware Has Been Exploiting Cisco FMC Zero-Day CVE-2026-20131 Since January

Interlock Ransomware Exploiting Maximum-Severity Cisco Firewall Zero-Day

The Interlock ransomware gang has been actively exploiting a maximum-severity remote code execution (RCE) vulnerability in Cisco Secure Firewall Management Center (FMC) software since late January 2026 — operating as a zero-day for weeks before the flaw was publicly disclosed. The attacks were reported concurrently by BleepingComputer and The Hacker News on March 18, 2026, with threat intelligence also credited to Amazon Threat Intelligence.

The vulnerability, tracked as CVE-2026-20131 with a CVSS score of 10.0, is caused by insecure deserialization in Cisco's FMC web interface. Because the vulnerable endpoint requires no authentication, remote attackers can send a maliciously crafted serialized object over the network and achieve unauthenticated root-level code execution on the FMC appliance — the system responsible for centrally managing Cisco firewalls, intrusion prevention systems, and network security policies across an organization.

Incident Details

The Vulnerability: CVE-2026-20131

CVE-2026-20131 is a critical flaw in the web-based management interface of Cisco Secure Firewall Management Center. The vulnerability stems from improper handling of serialized Java objects submitted by unauthenticated users.

How the Exploit Works

1. Attacker identifies a Cisco FMC instance reachable over the network
2. Attacker crafts a malicious serialized Java object payload
3. Attacker sends the payload to the vulnerable FMC endpoint
   — no credentials or authentication token required
4. The FMC deserializes the object without validation
5. Deserialization triggers arbitrary code execution as root
6. Attacker has full, unauthenticated root access to the FMC appliance

Why This Is Catastrophic

Cisco Secure Firewall Management Center is not a typical application server. It is the central management plane for an organization's network security infrastructure. Compromising the FMC gives an attacker:

An attacker with root on the FMC can effectively blind an organization's network security team while freely moving through the environment.

Interlock Ransomware: Threat Actor Profile

Interlock is a ransomware-as-a-service (RaaS) operation that emerged in late 2024. The group operates a double-extortion model — exfiltrating sensitive data before encrypting systems, then threatening victims with public exposure on their Tor-based leak site if ransom demands are not met.

Interlock's decision to weaponize a zero-day in Cisco FMC — high-value, high-privilege infrastructure — represents a significant escalation in capability and intent. Organizations using Cisco FMC are now a primary target of a sophisticated, financially motivated threat actor.

Timeline of Exploitation

The two-month zero-day exploitation window means organizations that have not patched may already be compromised. Incident response — not just patching — is warranted.

Impact Assessment

Detection Guidance

Indicators of Compromise

Network-level:

• Unexpected outbound connections from the FMC appliance
• HTTP requests to FMC endpoints containing serialized Java object headers (Content-Type: application/x-java-serialized-object or similar)
• Unusual authentication events on the FMC management interface

Host-level (FMC appliance):

• Unexpected processes running as root that are not part of normal FMC operation
• New user accounts created on the FMC
• Changes to firewall policy configurations not correlated with authorized change requests
• Suspicious cron jobs or persistence mechanisms

Ransomware deployment indicators:

• Unusual file encryption activity across managed hosts
• Communications to known Interlock Tor infrastructure
• Data staging activity prior to encryption (large compressed archives, abnormal network exfiltration)

Recommended Detection Rules

RULE: Alert on any process spawned as root by the FMC web application
RULE: Alert on unexpected FMC configuration changes not in the change management system
RULE: Alert on inbound serialized Java object payloads to FMC endpoints
RULE: Alert on new administrative accounts created on FMC outside the provisioning workflow

Immediate Response Actions

Priority 1: Patch Immediately

Apply the Cisco patch for CVE-2026-20131 immediately. This is a CVSS 10.0 actively exploited vulnerability — delay is not acceptable.

1. Obtain the patch from Cisco's security advisory page
2. Schedule an emergency change window if needed — this cannot wait for normal patching cycles
3. Apply to all FMC instances across the environment

Priority 2: Assume Compromise — Initiate Incident Response

Because exploitation has been ongoing since January 2026, organizations should not simply patch and move on. Initiate incident response procedures:

1. Preserve FMC logs before patching — logs may be wiped by attackers or during patching
2. Audit all FMC admin accounts — identify any unauthorized accounts
3. Review firewall policy changes — look for rules added or modified since January 2026 that were not authorized
4. Check for persistence mechanisms — review cron jobs, startup scripts, and installed packages on the FMC
5. Threat hunt across managed devices — look for lateral movement to firewalls and connected infrastructure

Priority 3: Network Isolation

# While patching is in progress:
# Restrict FMC management interface to management VLAN only
# Block all external access to FMC management ports
# Example firewall rule (adjust as appropriate for your environment):
iptables -I INPUT -p tcp --dport 443 -s <MGMT_VLAN_CIDR> -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j DROP

Key Takeaways

1. CVE-2026-20131 is CVSS 10.0 and has been actively exploited since January 2026 — this is a maximum-severity, actively exploited zero-day requiring immediate patching
2. Interlock ransomware chose Cisco FMC as a target because compromising it gives near-total control over an organization's network security posture
3. Two months of silent exploitation means organizations should treat this as a potential compromise event, not just a patching exercise
4. Double extortion means even if ransomware is not deployed, stolen data may still be weaponized
5. Organizations using Cisco FMC that have not patched should initiate incident response procedures in parallel with applying the patch
6. This attack underscores the risk of exposing network management plane interfaces — FMC should never be reachable from untrusted networks

Sources

• Ransomware gang exploits Cisco flaw in zero-day attacks since January — BleepingComputer
• Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access — The Hacker News
• Cisco Security Advisory: CVE-2026-20131 — Cisco PSIRT