Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Interlock Cisco Secure Firewall Management Center zero-day exploitation wave

Exploitation Wave
First reported
Last updated
Happening score
H score 59
2 unique sources, 3 articles

Summary

Hide ▲

A zero-day exploitation wave tied to Interlock has been hitting Cisco Secure Firewall Management Center (FMC), putting enterprise firewalls at risk before patching. Cisco's CVE-2026-20131 fix on March 4 addressed a flaw that could let unauthenticated attackers run arbitrary Java code as root on unpatched devices. Amazon said the abuse began on January 26, 2026, giving attackers a head start before public disclosure.

Cases

Cisco FMC zero-day exploitation and KEV response (4)

Related Happenings

Cisco Catalyst SD-WAN authentication bypass flaw actively exploited (CVE-2026-20182)

Vulnerability
H score60 First: 14.05.2026 23:09 Last: 14.05.2026 23:09 Sources 1

About this happening: CVE-2026-20182 is an actively exploited authentication bypass in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, creating a path to administr...

Latest development: 14.05.2026 23:25

Cisco released a patch for CVE-2026-20182, giving organizations using Cisco Catalyst SD-WAN Controllers a way to block the authentication bypass before UAT-8616 can continue using it for administrative access, SSH key insertion, NETCONF changes, and root escalation.

Open Happening

CISA KEV listing and FCEB firewall directive for CVE-2026-0300

Public Sector Action
H score64 First: 07.05.2026 13:57 Last: 07.05.2026 13:57 Sources 1

About this happening: CISA added CVE-2026-0300 to the KEV Catalog and ordered FCEB agencies to secure vulnerable firewalls by May 9, 2026. The federal directive makes the exploited...

Open Happening

Cisco security patch release for CVE-2026-20188

Security Patch Release
H score35 First: 06.05.2026 21:06 Last: 06.05.2026 21:06 Sources 1

About this happening: Cisco released security updates for CVE-2026-20188, a high-severity DoS vulnerability in Crosswork Network Controller (CNC) and Network Services Orchestrator (NS...

Open Happening

Cisco ASA/FTD code execution and authentication bypass flaws (multiple vulnerabilities)

Vulnerability
H score88 First: 24.04.2026 20:06 Last: 24.04.2026 20:06 Sources 1

About this happening: Cisco ASA/FTD vulnerabilities CVE-2025-20333 and CVE-2025-20362 are still under active exploitation and can be chained for unauthenticated remote control of af...

Open Happening

Cisco Catalyst SD-WAN Manager information disclosure vulnerability (CVE-2026-20133)

Vulnerability
H score7 First: 21.04.2026 15:30 Last: 21.04.2026 15:30 Sources 1

About this happening: CISA moved CVE-2026-20133 in Cisco Catalyst SD-WAN Manager into its KEV Catalog, signaling active exploitation against unpatched devices and forcing FCEB age...

Open Happening

Timeline

  1. 18.03.2026 18:53 2 articles · 3mo ago

    Interlock exploits Cisco Secure Firewall Management Center zero-day

    Exploitation Observed

    Interlock ransomware gang exploited CVE-2026-20131 in Cisco Secure Firewall Management Center (FMC) as a zero-day beginning January 26, 2026, targeting enterprise firewalls and enabling unauthenticated remote Java code execution as root on unpatched devices through a crafted serialized Java object sent to the web-based management interface.

    Show sources
    Open in new tab
  2. 18.03.2026 18:53 2 articles · 3mo ago

    Cisco patches CVE-2026-20131 in Secure Firewall Management Center

    Mitigation Patch Update

    Cisco patched CVE-2026-20131 in Cisco Secure Firewall Management Center (FMC) on March 4, 2026, warning that the insecure deserialization flaw in a user-supplied Java byte stream could let unauthenticated attackers execute arbitrary Java code as root on unpatched devices.

    Show sources
    Open in new tab
  3. 18.03.2026 18:53 1 articles · 3mo ago

    Amazon reports Interlock exploitation of Cisco CVE-2026-20131

    Initial Disclosure

    Amazon threat intelligence reported that Interlock had been exploiting CVE-2026-20131 in attacks against enterprise firewalls before public disclosure and shared the findings with Cisco, while Cisco still had not flagged the flaw as actively exploited.

    Show sources
    Open in new tab