sak110/cve-2026-20131Detection and proof-of-concept exploit for CVE-2026-20131, a critical unauthenticated Java deserialization RCE in Cisco Secure FMC. Includes a safe detection probe and a ysoserial-based PoC for authorized lab and CTF environments.
Severity: Critical (CVSS 3.1: 10.0) CWE: CWE-502 — Deserialization of Untrusted Data Affected: Cisco Secure Firewall Management Center (FMC) Software Advisory: cisco-sa-fmc-rce-NKhnULJh Bug ID: CSCwt14636
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software allows an unauthenticated, remote attacker to execute arbitrary Java code as root on the affected device.
The vulnerability stems from insecure deserialization of a user-supplied Java byte stream. An attacker can send a crafted serialized Java object to the FMC web interface, triggering arbitrary code execution with root privileges — no authentication required.
Note: Cisco Security Cloud Control (SCC) Firewall Management (SaaS) is also affected and has been patched automatically by Cisco.
The FMC web interface accepts and deserializes Java objects from unauthenticated HTTP requests without validating the object type or content. Java deserialization is inherently dangerous when applied to untrusted input — the JVM executes code embedded in the object graph during readObject(), before any application-level validation can run.
Attack flow:
Attacker → crafted serialized Java object (HTTP POST) → FMC readObject() → gadget chain fires → root RCE
Java serialization magic bytes that identify the start of a serialized stream:
AC ED 00 05
| Product | Status |
|---|---|
| Cisco Secure Firewall Management Center (FMC) Software | Vulnerable — patch available |
| Cisco Security Cloud Control (SCC) Firewall Management | Vulnerable — patched automatically by Cisco |
| Cisco Secure Firewall ASA Software | Not affected |
| Cisco Secure Firewall Threat Defense (FTD) Software | Not affected |
Use the Cisco Software Checker for specific affected version numbers.
| File | Description |
|---|---|
check.py | Safe detection probe — no gadget chain |
poc.py | PoC exploit via ysoserial — lab/CTF environments only |
check_cve_2026_20131.py probes known FMC endpoints by sending Java serialization magic bytes and inspecting the HTTP response. A 500 or unexpected 200 on a serialization endpoint suggests the server is processing (deserializing) the input rather than rejecting it.
No exploit payload or gadget chain is used.
pip install requests
python3 check.py https://<fmc-host>
| Result | Meaning |
|---|---|
POTENTIALLY VULNERABLE | Endpoint processed serialized bytes |
No obvious exposure detected | Likely patched or endpoints unreachable |
poc.py builds a deserialization payload using ysoserial and delivers it to the target FMC endpoint.
For authorized lab and CTF environments only.
See poc.py for full usage, requirements, and setup instructions.
Cisco has released fixed software. There are no workarounds.
Apply the patch from the official advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
Interim hardening (while patching):
AC ED 00 05 magic bytes in HTTP POST bodies| Date | Event |
|---|---|
| 2026-03-04 | Cisco advisory published — v1.0 Final |
| 2026-03-04 | Part of March 2026 Cisco Secure Firewall Bundled Advisory release |
Discovered during internal security testing by Keane O'Kelley, Cisco Advanced Security Initiatives Group (ASIG).
This repository is published for educational and authorized security research purposes only. Only use against systems you own or have explicit written permission to test. Unauthorized use may violate the Computer Fraud and Abuse Act (CFAA) and equivalent laws in your jurisdiction.