CISA Warns of Cisco Secure Firewall Management Center 0-Day Exploited in Ransomware Attacks

CISA has warned of a critical zero-day (CVE-2026-20131) in Cisco Secure Firewall Management Center and Cisco Security Cloud Control—an unauthenticated deserialization flaw (CWE-502) in the web management interface that permits remote execution of arbitrary Java code as root. The vulnerability is confirmed to be actively exploited in ransomware campaigns, has been added to the CISA Known Exploited Vulnerabilities Catalog with a federal remediation deadline, and organizations are urged to apply vendor mitigations, restrict access to management interfaces, or take affected systems offline until patched.