CISA Warns Cisco Secure Firewall Management Center 0-Day Is Being Exploited in Ransomware Attacks

CISA warns of a critical zero-day (CVE-2026-20131) in Cisco Secure Firewall Management Center and Cisco Security Cloud Control: an unauthenticated Java deserialization RCE (CWE-502) that can yield root code execution. The flaw is being actively exploited by ransomware operators, was added to CISA's Known Exploited Vulnerabilities catalog on March 19, 2026, and organizations are ordered to apply mitigations or isolate affected management interfaces by the emergency deadline of March 22, 2026.