Cisco FMC Zero-Day: How Interlock Ransomware Exploited Firewalls for 36 Days

How a Firewall Became the Entry Point

On March 4, 2026, Cisco published an emergency advisory for CVE-2026-20131, a critical insecure deserialization vulnerability in its Secure Firewall Management Center (FMC) software. The flaw received the maximum CVSS score of 10.0: an unauthenticated attacker could execute arbitrary Java code as root on the FMC appliance by sending a single crafted HTTP request to its web management interface.

The advisory came weeks too late. Amazon threat intelligence research, conducted using its MadPot global honeypot network, revealed that the Interlock ransomware group had been exploiting CVE-2026-20131 as a zero-day since January 26, 2026 — a 36-day window during which no patch existed and most defenders had no idea the vulnerability was present.

CISA added CVE-2026-20131 to its Known Exploited Vulnerabilities catalog on March 19, mandating that all federal agencies patch by April 9, 2026.

Inside CVE-2026-20131: Deserialization at Root Level

The vulnerability resides in the web-based management interface of Cisco FMC. The platform processes serialized Java objects received through its HTTP management API. CVE-2026-20131 exists because the FMC deserializes user-supplied Java byte streams without adequate validation, allowing an attacker to inject a malicious serialized object that triggers arbitrary code execution.

Cisco scores the flaw at 10.0 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Every metric is at its worst: network-reachable, low complexity, no authentication, no user interaction, and impact that extends beyond the FMC itself to all managed firewall appliances.

The “Scope: Changed” designation is critical. Cisco FMC is the central management platform for Firepower Threat Defense (FTD) devices. It stores firewall policies, network topology maps, security event logs, credential stores for Active Directory integration, and VPN configurations. Root access to the FMC gives an attacker a comprehensive map of the target network and the ability to modify firewall rules — effectively handing them the keys to the infrastructure the appliance was deployed to protect.

Cisco confirmed there are no workarounds. The only remediation is applying the patch. Restricting access to the FMC web interface to trusted management networks reduces the attack surface but does not eliminate the vulnerability. Affected versions span 6.4.0, 7.0.x through 7.7.x, and 10.0.0.

Interlock: The Ransomware Group Behind the Campaign

Interlock first appeared in September 2024 and has since claimed over 60 victims across North America and Europe. Unlike most ransomware operators, Interlock does not run a ransomware-as-a-service (RaaS) program — it operates independently, developing its own encryption tools for both Windows and Linux, and maintains a private leak site called “Worldwide Secrets Blog” to pressure victims through double extortion.

The group has demonstrated a pattern of targeting sectors where operational disruption drives ransom payment. Healthcare has been a recurring focus: in 2025, Interlock was responsible for the DaVita breach in April (compromising data of 2.7 million individuals from the kidney dialysis provider) and the Kettering Health attack in May (disrupting 14 hospitals and 120+ outpatient facilities in Ohio, with dozens of lawsuits filed for delayed patient care). The group also struck Texas Tech University System and the city of Saint Paul, Minnesota.

Interlock’s initial access methods have evolved across three documented phases. Early campaigns used drive-by downloads from compromised legitimate websites. By February 2025, the group added ClickFix social engineering — impersonating remote connectivity software like FortiClient VPN and Cisco AnyConnect. In July 2025, CISA and the FBI issued a joint #StopRansomware advisory warning that Interlock had upgraded its malware, including a custom NodeSnake remote access trojan and, more recently, an AI-generated malware strain called Slopoly.

The exploitation of CVE-2026-20131 marks a significant capability escalation. Using a zero-day in a major security vendor’s flagship firewall management platform places Interlock in a higher tier than groups relying on known vulnerabilities and commodity access brokers.

How the Attack Unfolded

Amazon’s threat intelligence teams pieced together the campaign after Cisco’s March 4 disclosure. Using MadPot — Amazon’s global network of honeypot servers — researchers identified exploitation activity dating to January 26, 2026. An operational security mistake by the Interlock operators — a misconfigured infrastructure server — exposed the group’s complete attack toolkit.

The observed attack chain works as follows:

1. Initial exploitation: Crafted HTTP requests containing malicious serialized Java objects are sent to the FMC web management interface. On successful exploitation, the compromised FMC performs an HTTP PUT request to an attacker-controlled server, confirming the breach.

1. Payload delivery: Commands instruct the compromised FMC to download an ELF binary from a remote server hosting additional Interlock tools.

1. Network enumeration: PowerShell scripts systematically map the victim’s Windows environment — collecting operating system details, hardware information, running services, installed software, storage configuration, and browser data across multiple machines.

1. Persistent access: Custom remote access trojans written in JavaScript and Java maintain C2 communication, enabling command execution, file transfers, and encrypted data exfiltration.

1. Evasion: A Bash script converts compromised Linux servers into HTTP reverse proxies that forward traffic to attacker-controlled systems while erasing logs every five minutes, making forensic analysis extremely difficult.

1. Ransomware deployment: After data exfiltration, Interlock deploys its custom encryptors across the victim environment, appending the `.interlock` extension to encrypted files and dropping ransom notes directing victims to a Tor negotiation portal.

Amazon confirmed that AWS infrastructure and customer workloads were not involved in the campaign.

The Structural Problem: Security Appliances as Attack Surface

CVE-2026-20131 belongs to a growing category of vulnerabilities that undermine the traditional perimeter security model: critical flaws in the security appliances themselves. Firewalls, VPN gateways, and management platforms sit at the network boundary, process untrusted input, and — when compromised — provide attackers a privileged vantage point with access to security policies, event logs, and stored credentials.

The pattern has been consistent over the past three years. Ivanti Connect Secure suffered multiple zero-days exploited by state-sponsored actors in 2024 and 2025. Palo Alto Networks patched CVE-2024-3400, a command injection in GlobalProtect exploited as a zero-day. Fortinet addressed multiple critical authentication bypass flaws across 2023-2025. Citrix NetScaler’s CVE-2023-4966 (“Citrix Bleed”) was exploited at scale by ransomware groups.

The management interface exposure problem persists because of operational convenience (administrators wanting remote access), cloud migration (management interfaces placed in cloud-accessible segments), and VPN dependency (if the VPN is compromised, the management interface behind it is also exposed).

For healthcare organizations, the problem is compounded by understaffed IT teams, complex clinical environments mixing modern and legacy systems, and the high cost of maintenance windows that may disrupt patient care. Interlock has repeatedly demonstrated its willingness to exploit this bind.

Responding to CVE-2026-20131

Organizations running Cisco FMC should treat this as an emergency:

• Patch immediately. Apply the March 4, 2026 update. There are no workarounds.
• Restrict management access. Move the FMC web interface to a dedicated management VLAN accessible only from known administrator workstations.
• Conduct forensic triage. Review FMC logs for January 26 through March 4 for anomalous HTTP POST requests, unexpected process execution, and unauthorized firewall policy changes.
• Audit Active Directory. Look for new administrative accounts, group membership changes, Kerberos ticket anomalies, and unexpected RDP connections.
• Verify backup integrity. Interlock specifically targets backup infrastructure. Confirm backups are intact and recoverable.
• Deploy integrity monitoring. File integrity monitoring (FIM) on FMC appliances can detect unauthorized filesystem changes indicating post-exploitation activity.

Sources & Further Reading

• Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access — The Hacker News
• Ransomware Gang Exploits Cisco Flaw in Zero-Day Attacks Since January — BleepingComputer
• Amazon Threat Intelligence: Interlock Ransomware Campaign Targeting Enterprise Firewalls — AWS Security Blog
• Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks — SecurityWeek
• CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalog — CISA
• Cisco FMC Flaw Was Exploited by Interlock Weeks Before Patch — Help Net Security