Critical
KEV + Ransomware
CVE-2026-20131
Interlock Ransomware Exploits Cisco Zero-Day and Uses Legitimate Tools
Vendor / product: Cisco Secure Firewall Management Center (FMC) Software
Event date: 2026-03-01
Victim organization: the customer
Public PoC: Yes
First tracked by RiskWire: 2026-07-28
CISA KEV catalog
Added to KEV
Federal remediation due
2026-03-22 (182 days overdue)
Ransomware campaign use
Known
CISA description
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
InterlockGOLD EMBRACE
Sources & citations (3)
- Interlock ransomware gang creates volatile situation sophos.com · 2026-08-04
- Sophos Warns Unprotected Endpoints Let Interlock Credential Theft Go Undetected gbhackers.com · 2026-08-10
- Interlock Turns the Tools Incident Responders Use Into Weapons for Stealing Windows Passwords cybersecuritynews.com · 2026-08-10
References
See CVE-2026-20131 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →