The critical vulnerability CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center was exploited as a zero-day by the Interlock ransomware gang beginning January 26, 2026. According to NVD data, affected versions include 6.4.0.13 through 6.4.0.17. Cisco released a patch for this flaw in early March 2026.
A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed. “Our research [using Amazon’s MadPot system of honeypots] found that Interlock was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026,” he said on Wednesday. CVE-2026-20131 exploited as zero-day for … More → The post Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) appeared first on Help Net Security .