Vulnerabilities · 224 days ago
Interlock abused a zero-day in Cisco FMC to run arbitrary Java code as root. AWS saw exploitation from Jan 26, 2026—36 days before Cisco's March 4 disclosure. A misconfigured Interlock server exposed the group's toolkit, indicators, and known victims in healthcare, education, and local government.
Known exploited · CISA KEV
CVSS 10 CRITICAL: a vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could… Known ransomware campaign use. EPSS 44% (99th percentile).
CISA federal remediation date Mar 22
9 sources covering this story
Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) - Help Net Security
A Cisco Secure FMC flaw (CVE-2026-20131) patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang.
Interlock Ransomware Targets Cisco Enterprise Firewalls
The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly disclosed.
The Record from Recorded Future
Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon
The Interlock ransomware gang recently exploited a zero-day vulnerability in a popular line of Cisco firewalls before the bug was disclosed publicly, according to an Amazon report.
CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks
Interlock exploits CVE-2026-20131 zero-day since Jan 26, enabling root access on Cisco FMC, increasing ransomware risks.
AWS Warns Hackers Have Abused Cisco Firewall Zero-Day Since January
Notorious ransomware group Interlock has been exploiting a Cisco zero-day bug since January, AWS says
Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks
Amazon found evidence that the FMC software vulnerability has been exploited since late January, and found links to Russia.
Interlock Ransomware Attack | Outbreak Alert | FortiGuard Labs
An active Interlock ransomware campaign is exploiting a critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC), e...
Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access
Interlock ransomware is actively exploiting CVE-2026-20131 (CVSS 10.0) in Cisco FMC, enabling unauthenticated remote code execution as root.
Amazon threat intelligence has identified an active Interlock ransomware campaign exploiting CVE-2026-20131, a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device, which was disclosed by Cisco on March 4, 2026.
Ransomware gang exploits Cisco flaw in zero-day attacks since January
The Interlock ransomware gang has been exploiting a maximum severity remote code execution (RCE) vulnerability in Cisco's Secure Firewall Management Center (FMC) software in zero-day attacks since late January.
Part of the PlainSec briefing for 2026-03-24