# Cisco FMC flaws exploited for Interlock ransomware

Published: 2026-09-11 · Severity: severe · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/0b7fa57d-794b-532f-b7a0-1abfc3b9d255/cisco-fmc-flaws-exploited-for-interlock-ransomware

> Two critical Cisco Secure Firewall Management Center vulnerabilities (CVSS 10.0) are being actively exploited, one since January to deploy Interlock ransomware.

NCSC-NL issued a high-priority advisory for two critical vulnerabilities in Cisco Secure Firewall Management Center (FMC), both rated CVSS 10.0. CVE-2026-20079 is an authentication bypass in the FMC web interface caused by an improperly created system process at startup, allowing an unauthenticated remote attacker to send crafted HTTP requests and execute scripts/commands with root privileges. CVE-2026-20131 is an insecure deserialization flaw in the web interface that allows an unauthenticated attacker to submit a specially crafted serialized Java object to achieve arbitrary code execution with root privileges.

According to Amazon threat intelligence, CVE-2026-20131 has likely been actively exploited since 26 January 2026 to deploy Interlock ransomware against enterprise firewalls. A public proof-of-concept has since been released for CVE-2026-20079, and Cisco has confirmed successful exploitation of that flaw in the wild (per Talos). NCSC-NL expects further public PoC release and large-scale exploitation attempts, and urges immediate patching. Organizations using the Cisco Security Cloud Control SaaS offering are automatically protected; on-premises FMC deployments require manual patching. Defenders should also retroactively review logs and network traffic back to 26 January using IOCs and detection guidance published in Amazon's blog, even if patches were applied promptly after disclosure.

Mitigating factors include reduced attack surface if the FMC management interface is not exposed directly to the public internet, which NCSC-NL notes is atypical configuration. However, given confirmed in-the-wild exploitation, ransomware deployment, and maximum CVSS severity, immediate patching and retrospective compromise investigation are strongly advised.

## Mentioned in this report

- Vulnerabilities: CVE-2026-20079 (KEV), CVE-2026-20131 (KEV)
- Threat actors: interlock
- Malware: Interlock
- Campaigns: Interlock ransomware campaign targeting enterprise firewalls

## Detection guidance (public sample)

### Cisco FMC Unauthenticated Script/Command Execution via Web Interface

ATT&CK: T1190

Detects HTTP requests to Cisco FMC web interface without authentication credentials, followed by script/command execution with root privileges - exploitation of CVE-2026-20079 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco FMC Unauthenticated Script/Command Execution via Web Interface
description: Detects unauthenticated HTTP POST/GET requests to Cisco FMC web interface
  endpoints that typically require authentication, indicative of exploitation of CVE-2026-20079
  authentication bypass leading to arbitrary command execution.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    DestinationHostname|contains: fmc
    DestinationPort: 443
    http_method:
    - POST
    - GET
    http_uri|contains:
    - /api/
    - /admin/
    - /config/
    http_user_agent|exists: true
  filter_authenticated:
    http_authorization|exists: true
  filter_internal:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_authenticated and not filter_internal
falsepositives:
- Health checks or monitoring probes from external security services
- Legitimate remote management accessing FMC over VPN without typical auth headers
  in proxy logs
level: high
id: 43bc8f83-e40a-56b4-b415-4832bc390b07
status: experimental
author: Vorant
```

### Cisco FMC Malicious Serialized Java Object Deserialization

ATT&CK: T1190

Detects HTTP requests to Cisco FMC web interface containing suspicious serialized Java objects in request body, exploitation of CVE-2026-20131 insecure deserialization flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco FMC Malicious Serialized Java Object Deserialization
description: Detects HTTP POST requests to Cisco FMC web interface with serialized
  Java object payloads in the request body, characteristic of CVE-2026-20131 insecure
  deserialization exploitation leading to arbitrary code execution.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    DestinationHostname|contains: fmc
    DestinationPort: 443
    http_method: POST
    http_request_body|contains:
    - aced0005
    - java.io.ObjectInputStream
    - rO0AB
  filter_internal:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
falsepositives:
- Legitimate Cisco FMC backup/restore operations using serialized Java objects
- Internal administrative tools that interact with FMC via serialized payloads
level: high
id: 45708398-9c6f-518b-b56f-26302e6cc22e
status: experimental
author: Vorant
```

### Cisco FMC Process Spawning Root-Privileged Command Execution

ATT&CK: T1068

Detects Cisco FMC web service process spawning shell commands with root/SYSTEM privileges, indicative of post-exploitation privilege escalation via CVE-2026-20079 or CVE-2026-20131. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco FMC Process Spawning Root-Privileged Command Execution
description: Detects Cisco FMC web interface process (typically running as root due
  to vulnerability) spawning shell commands or child processes, characteristic of
  successful exploitation of CVE-2026-20079 or CVE-2026-20131 leading to arbitrary
  code execution with elevated privileges.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - fmc
    - java
    ParentUser: root
    Image|endswith:
    - /bin/bash
    - /bin/sh
    - /usr/bin/perl
    - /usr/bin/python
    CommandLine|contains:
    - 'wget '
    - 'curl '
    - 'nc '
    - 'bash '
    - 'sh '
  filter_cisco_maintenance:
    CommandLine|contains:
    - upgrade
    - patch
    - health
  condition: selection and not filter_cisco_maintenance
falsepositives:
- Legitimate Cisco FMC upgrade/patch processes spawning shell commands
- Authorized system administration or monitoring scripts executed by FMC service
level: high
id: 23e96926-630b-5366-9ed4-a789c1877e39
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0076.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0b7fa57d-794b-532f-b7a0-1abfc3b9d255/cisco-fmc-flaws-exploited-for-interlock-ransomware.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup