Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

A critical zero-day vulnerability in Cisco Secure Firewall Management Center Software, identified as CVE-2026-20131, is being actively exploited by the Interlock ransomware campaign to gain root access. This flaw, which has a CVSS score of 10.0, allows unauthenticated remote attackers to deserialize user-supplied Java byte streams, enabling them to execute arbitrary code. The Interlock ransomware is leveraging this vulnerability to compromise targets, highlighting the urgent need for a patch or mitigation strategy. Amazon Threat Intelligence has warned of this active campaign, emphasizing the importance of monitoring and addressing the exploitation status of CVE-2026-20131¹. The severity of this vulnerability and its active exploitation by ransomware actors make it a high-priority concern for security teams, who must take immediate action to protect their networks and prevent potential breaches, as the exploitation of this vulnerability could lead to significant financial and reputational losses.