Loading vulnerability…
CVE-2026-20131 is a critical insecure deserialization vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. The flaw is caused by unsafe deserialization of a user-supplied Java byte stream. An unauthenticated remote attacker can exploit the issue by sending a crafted serialized Java object to the exposed management interface of an affected device. Successful exploitation results in arbitrary Java code execution on the target system and can lead to execution with root privileges. The vulnerability has also been reported as affecting Cisco Security Cloud Control Firewall Management, while Cisco Secure Firewall ASA and Secure Firewall Threat Defense are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
Repository contains a detection script and an RCE PoC for CVE-2026-20131 (Cisco Secure Firewall Management Center Java deserialization). Structure: (1) README.md documents the vulnerability, affected products, and usage. (2) check.py is a safe network probe that POSTs Java serialization magic bytes (0xACED0005) with Content-Type application/x-java-serialized-object to several FMC endpoints (/j_spring_security_check, /api/fmc_platform/v1/auth/generatetoken, /dispatcher, /invoker/JMXInvokerServlet, /invoker/EJBInvokerServlet) and flags HTTP 500/200 as potential deserialization handling. (3) poc.py is an operational PoC exploit that generates a malicious serialized object using an external tool (ysoserial-all.jar executed via local Java) with selectable gadget chains (CommonsCollections*, Spring*, Groovy1) and an attacker-supplied command, then POSTs the payload to likely deserialization endpoints. The exploit is unauthenticated and intended to achieve blind command execution (often inferred from HTTP 500 and/or out-of-band callbacks such as reverse shells or DNS). No persistence is implemented; payload is arbitrary command execution.
Repository contains a claimed working PoC exploit for CVE-2026-20131 targeting Cisco Catalyst SD-WAN Controller (vSmart) and Catalyst SD-WAN Manager (vManage). Structure: (1) `CVE-2026-20131-POC.py` is the main exploit entry point but is PyArmor-obfuscated/encrypted, preventing static extraction of exact request paths, parameters, or hardcoded targets from the provided content. (2) `cmd.jsp` is a JSP webshell payload that executes arbitrary OS commands supplied via the `cmd` HTTP parameter using `bash -c`, returning both stdout and stderr—indicative of post-exploitation persistence/command execution. (3) `README.md` describes capabilities: pre-auth auth bypass, admin privilege gain, ability to create a rogue peer in the SD-WAN control/management plane, and access to NETCONF on TCP/830. Fingerprintable observables available from the repo content are limited to the Telegram URL and the NETCONF port reference; any additional exploit endpoints (e.g., specific vManage/vSmart API paths) are likely embedded inside the obfuscated Python script and are not visible here.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
218 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical-severity zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) Software that the Interlock ransomware threat actor was actively exploiting.
A remote code execution vulnerability in Cisco Secure Firewall Management Center that can be exploited via a crafted serialized Java object sent to the web-based management interface.
A separate Cisco Secure Firewall Management Center vulnerability mentioned only in related content.
A CVSS 10.0 vulnerability affecting Cisco Secure Firewall.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.