Vulnerabilità ed exploit · Ransomware

Interlock Sfrutta Zero-Day su Firewall Cisco per Accesso Root

Interlock ha sfruttato un zero-day in Cisco Secure Firewall Management Center (CVE-2026-20131) per eseguire codice Java arbitrario come root su dispositivi FMC esposti a internet. Amazon/AWS threat intelligence ha osservato lo sfruttamento dal 26 gennaio 2026, 36 giorni prima della disclosure Cisco del 4 marzo, fornendo accesso anticipato alle reti aziendali. Incidenti correlati colpiscono la sanità, l'istruzione e le amministrazioni locali e altri settori.

9 fonti · 20 mar

CVE-2026-20131

NVD KEV

Sfruttamento noto · CISA KEV

CVSS 10 CRITICAL: a vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could… Impiego noto in campagne ransomware. EPSS 43% (99º percentile).

Data di correzione federale CISA 22 mar

Cronologia

22 mar Scadenza federale CISA per CVE-2026-20131
20 mar Segnalato da Help Net Security
19 mar Segnalato da The Record from Recorded Future
18 mar Segnalato da AWS Security Blog

Fonti

20 mar Help Net Security
Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) - Help Net Security
A Cisco Secure FMC flaw (CVE-2026-20131) patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang.
originale
20 mar Dark Reading
Interlock Ransomware Targets Cisco Enterprise Firewalls
The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly disclosed.
originale
19 mar The Record from Recorded Future
Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon
The Interlock ransomware gang recently exploited a zero-day vulnerability in a popular line of Cisco firewalls before the bug was disclosed publicly, according to an Amazon report.
originale

Riepilogo fornitore: Cisco

Part of the PlainSec briefing for 2026-03-21

Every edition of this story: Interlock Sfrutta Zero-Day su Firewall Cisco per Accesso Root

Altro da oggi

Vulnerabilità ed exploit · RansomwareInterlock Sfrutta Zero-Day su Firewall Cisco per Accesso RootInterlock ha sfruttato un zero-day in Cisco Secure Firewall Management Center (CVE-2026-20131) per eseguire codice Java arbitrario come root su dispositivi FMC esposti a internet. Amazon/AWS threat intelligence ha osservato lo sfruttamento dal 26 gennaio 2026, 36 giorni prima della disclosure Cisco del 4 marzo, fornendo accesso anticipato alle reti aziendali. Incidenti correlati colpiscono la sanità, l'istruzione e le amministrazioni locali e altri settori.9 fonti · 20 mar

CVE-2026-20131

NVD KEV

Sfruttamento noto · CISA KEV

Data di correzione federale CISA 22 mar

Cronologia

22 mar Scadenza federale CISA per CVE-2026-20131

20 mar Segnalato da Help Net Security

19 mar Segnalato da The Record from Recorded Future

18 mar Segnalato da AWS Security Blog

Fonti

20 mar Help Net Security

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) - Help Net Security

A Cisco Secure FMC flaw (CVE-2026-20131) patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang.

originale

20 mar Dark Reading

Interlock Ransomware Targets Cisco Enterprise Firewalls

The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly disclosed.

originale

19 mar The Record from Recorded Future

Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon

The Interlock ransomware gang recently exploited a zero-day vulnerability in a popular line of Cisco firewalls before the bug was disclosed publicly, according to an Amazon report.

originale

Riepilogo fornitore: CiscoPart of the PlainSec briefing for 2026-03-21Every edition of this story: Interlock Sfrutta Zero-Day su Firewall Cisco per Accesso RootAltro da oggi

Sfruttata in natura falla critica di Microsoft SharePoint

Vulnerabilità Critica di Langflow Sfruttata in 20 Ore

ScreenConnect vulnerabile, SILENTCONNECT abilita accesso non autorizzato