Cisco FMC flaws exploited for Interlock ransomware
Two critical Cisco Secure Firewall Management Center vulnerabilities (CVSS 10.0) are being actively exploited, one since January to deploy Interlock ransomware.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-20079 and CVE-2026-20131 as exploited in the wild.
NCSC-NL issued a high-priority advisory for two critical vulnerabilities in Cisco Secure Firewall Management Center (FMC), both rated CVSS 10.0. CVE-2026-20079 is an authentication bypass in the FMC web interface caused by an improperly created system process at startup, allowing an unauthenticated remote attacker to send crafted HTTP requests and execute scripts/commands with root privileges. CVE-2026-20131 is an insecure deserialization flaw in the web interface that allows an unauthenticated attacker to submit a specially crafted serialized Java object to achieve arbitrary code execution with root privileges.
According to Amazon threat intelligence, CVE-2026-20131 has likely been actively exploited since 26 January 2026 to deploy Interlock ransomware against enterprise firewalls. A public proof-of-concept has since been released for CVE-2026-20079, and Cisco has confirmed successful exploitation of that flaw in the wild (per Talos). NCSC-NL expects further public PoC release and large-scale exploitation attempts, and urges immediate patching. Organizations using the Cisco Security Cloud Control SaaS offering are automatically protected; on-premises FMC deployments require manual patching. Defenders should also retroactively review logs and network traffic back to 26 January using IOCs and detection guidance published in Amazon's blog, even if patches were applied promptly after disclosure.
Mitigating factors include reduced attack surface if the FMC management interface is not exposed directly to the public internet, which NCSC-NL notes is atypical configuration. However, given confirmed in-the-wild exploitation, ransomware deployment, and maximum CVSS severity, immediate patching and retrospective compromise investigation are strongly advised.
Mentioned in this report
Detection guidance
Cisco FMC Process Spawning Root-Privileged Command Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Cisco FMC web service process spawning shell commands with root/SYSTEM privileges, indicative of post-exploitation privilege escalation via CVE-2026-20079 or CVE-2026-20131. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco FMC Process Spawning Root-Privileged Command Execution
description: Detects Cisco FMC web interface process (typically running as root due
to vulnerability) spawning shell commands or child processes, characteristic of
successful exploitation of CVE-2026-20079 or CVE-2026-20131 leading to arbitrary
code execution with elevated privileges.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- fmc
- java
ParentUser: root
Image|endswith:
- /bin/bash
- /bin/sh
- /usr/bin/perl
- /usr/bin/python
CommandLine|contains:
- 'wget '
- 'curl '
- 'nc '
- 'bash '
- 'sh '
filter_cisco_maintenance:
CommandLine|contains:
- upgrade
- patch
- health
condition: selection and not filter_cisco_maintenance
falsepositives:
- Legitimate Cisco FMC upgrade/patch processes spawning shell commands
- Authorized system administration or monitoring scripts executed by FMC service
level: high
id: 23e96926-630b-5366-9ed4-a789c1877e39
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0076.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs