Exploited in the Wild: Interlock Ransomware Weaponizes Critical 10.0 CVSS Cisco Zero-Day

Amazon uncovered an active Interlock ransomware campaign exploiting a critical zero-day (CVE-2026-20131, CVSS 10) in Cisco Secure Firewall Management Center that allows unauthenticated remote root code execution via insecure Java deserialization; the group used the flaw since January, deployed custom Java/JavaScript RATs and a fileless JVM webshell, and operated a staging server that revealed comprehensive tooling for reconnaissance, laundering, and log erasure—organizations using FMC should apply Cisco’s patches immediately.