CVE-2026-20131 CISA KEV · Actively exploitedLinked to ransomwareSuited to automated attack · CISA
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
CVSS score
10.0
EPSS probability
%43.2
Risk score
8.6
Published
7 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Post-incident report on CVE-2026-20131 (CVSS 10.0), a Cisco FMC insecure deserialization vulnerability exploited by Interlock ransomware. Details root-cause analysis, lateral movement tactics, and emergency containment strategies.
Makefile Go / Python
Similar Vulnerabilities
10.0
CVE-2021-44228 Actively exploitedImproper input validation in Apache Log4j
Patch verified Public Exploits:22EPSS %100
10.0
CVE-2026-20079 Actively exploitedCisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
Workaround Public Exploits:3EPSS %88
8.6
CVE-2026-20230 Actively exploitedCisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Workaround Public Exploits:1EPSS %88
7.5
CVE-2020-3452 Actively exploitedImproper input validation in Cisco Adaptive Security Appliance Software
Workaround Public Exploits:17EPSS %100
7.5
CVE-2018-0296 Actively exploitedImproper input validation in Cisco Firepower Threat Defense
Workaround Public Exploits:9EPSS %100
8.6
CVE-2025-20362 Actively exploitedMissing authorization in Cisco Secure Firewall Threat Defense
Workaround Public Exploits:2EPSS %87
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-20131"