LmCast :: Stay tuned in

CISA orders feds to patch max-severity Cisco flaw by Sunday

Recorded: March 20, 2026, 5 p.m.

Original Summarized

CISA orders feds to patch max-severity Cisco flaw by Sunday

News

Featured
Latest

Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

Microsoft Azure Monitor alerts abused for callback phishing attacks

Musician admits to $10M streaming royalty fraud using AI bots

FBI links Signal phishing attacks to Russian intelligence services

Varonis Atlas: Securing AI and the Data That Powers It

Microsoft Exchange Online service change causes email access issues

Block ads and trackers on 9 devices for only $16 in this deal

FBI warns of Handala hackers using Telegram in malware attacks

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityCISA orders feds to patch max-severity Cisco flaw by Sunday

CISA orders feds to patch max-severity Cisco flaw by Sunday

By Bill Toulas

March 20, 2026
11:09 AM
0

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability, CVE-2026-20131, in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22.
Cisco published a security bulletin about the flaw on March 4, urging system administrators to apply the security updates as soon as possible and warning that no workarounds are available.
The Cisco Secure Firewall Management Center (FMC) is a centralized administration system for critical Cisco network security appliances, such as firewalls, application control, intrusion prevention, URL filtering, and malware protection.
“A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device,” Cisco says in the advisory.
The issue is caused by insecure deserialization of a user-supplied Java byte stream and is exploitable by sending a specially crafted serialized Java object to the web-based management interface of an affected device.
On March 18, the vendor updated its bulletin to warn of active exploitation of CVE-2026-20131 in the wild. Amazon threat intelligence researchers confirmed that threat actors are leveraging the vulnerability in attacks, noting that the Interlock ransomware gang had been exploiting it as a zero-day since the end of January.
Amazon stated that the ransomware threat actor exploited CVE-2026-20131 more than a month before the vendor published the patch.
Interlock ransomware has claimed several high-profile victims since its launch in late 2024, including DaVita, Kettering Health, the Texas Tech University System, and the city of Saint Paul, Minnesota.
The threat actor is also using the ClickFix technique for initial access, as well as custom remote access trojans and malware strains like NodeSnake and Slopoly.
CISA has added CVE-2026-20131 to its Known Exploited Vulnerabilities (KEV) catalog, marking it as “known to be used in ransomware campaigns.”
Given the severity of CVE-2026-20131 and its active exploitation status since late January 2026, CISA gave Federal Civilian Executive Branch (FCEB) agencies only until this Sunday to apply the security updates or stop using the product.
CISA’s deadline is relevant to all entities subject to the Binding Operational Directive (BOD) 22-01, but private firms, state/local governments, and all non-FCEB organizations are still recommended to consider it and act accordingly.

Red Report 2026: Why Ransomware Encryption Dropped 38%
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Download The Report

Related Articles:
Ransomware gang exploits Cisco flaw in zero-day attacks since JanuaryCISA: BeyondTrust RCE flaw now exploited in ransomware attacksCISA gives feds 3 days to patch actively exploited BeyondTrust flawSolarWinds Web Help Desk flaw is now exploited in attacksCISA confirms active exploitation of four enterprise software bugs

Actively Exploited
CISA
Cisco
Cisco Secure FMC
Deserialization
KEV
Remote Code Execution
Vulnerability

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

Microsoft: March Windows updates break Teams, OneDrive sign-ins

Microsoft Azure Monitor alerts abused for callback phishing attacks

Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

Sponsor Posts

Secure your AI agents without sacrificing speed.

AI is a data-breach time bomb: Read the new report

Are refund fraud methods targeting your brand? You can monitor the underground for these threats.

Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast.

Overdue a password health-check? Audit your Active Directory for free

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

CISA issued an urgent directive to federal agencies, mandating the patching of a maximum-severity vulnerability, CVE-2026-20131, within Cisco Secure Firewall Management Center (FMC) by March 22, 2026. This action stemmed from evidence of active exploitation of the flaw by the Interlock ransomware gang, a threat actor who had been leveraging the vulnerability as a zero-day since late January of that year. The vulnerability itself resides within the web-based management interface of the FMC software, allowing for unauthenticated, remote attackers to execute arbitrary Java code with root-level access. The mechanism involves the insecure deserialization of a user-supplied Java byte stream, a known attack vector.

Amazon threat intelligence researchers confirmed the exploitation, highlighting the concerning timeline, emphasizing that Interlock had been actively targeting systems prior to Cisco’s public disclosure of the security bulletin. The ransomware group’s tactics included utilizing the ClickFix technique for initial access and deploying custom remote access trojans like NodeSnake and Slopoly, further expanding the scope of potential damage. The vulnerability was subsequently added to CISA's Known Exploited Vulnerabilities (KEV) catalog, categorized as "known to be used in ransomware campaigns," signifying its immediate operational threat.

Given the critical nature of the vulnerability and the confirmed ongoing exploitation, CISA imposed a deadline for Federal Civilian Executive Branch (FCEB) agencies—a restriction to apply patches by March 22nd—effectively halting the use of the affected product. While the directive primarily applies to FCEB entities, CISA strongly advised all organizations subject to Binding Operational Directive (BOD) 22-01, as well as private firms, state/local governments, and non-FCEB entities, to prioritize mitigation. This urgency reflects a concerning trend of attackers exploiting zero-day vulnerabilities, particularly within widely deployed security infrastructure components. The situation underscores the importance of proactive vulnerability management and rapid response to emerging threats.