Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)

A critical zero-day (CVE-2026-20131) in Cisco Secure Firewall Management Center—an insecure Java deserialization in the FMC web interface—was actively exploited by the Interlock ransomware gang beginning January 26, 2026, enabling unauthenticated remote code execution and root escalation; Amazon/AWS observed the exploitation, recovered attacker tooling and malware, and published IOCs while Cisco and CISA issued advisories and mitigation guidance.