36 Days of Root: How Interlock Owned Cisco FMC Before the Patch

Mar 30
4 min read

Your Firewall Manager Has Root Access. So Did They.

Here's a scenario that should keep every network defender up at night: a ransomware gang discovers a CVSS 10.0 vulnerability in the console you use to manage your firewalls, exploits it to gain unauthenticated root access, and does this for 36 days before the vendor even knows about it. That's not a hypothetical. That's exactly what the Interlock ransomware gang pulled off against Cisco Secure Firewall Management Center (FMC) with CVE-2026-20131.

The Vulnerability: Insecure Deserialization at the Front Door

CVE-2026-20131 is an insecure deserialization vulnerability in Cisco FMC's web interface. The flaw exists in how FMC handles user-supplied Java byte streams — it deserializes them without proper validation, and it does so before authentication. Per Help Net Security, an unauthenticated remote attacker can send a crafted serialized Java object to the management interface and achieve arbitrary code execution as root.

Let that sink in: no credentials required, no user interaction, direct path to root on the box that controls your firewall rules. CVSS gave it a perfect 10.0, and honestly, it earned every decimal.

From a pentester's perspective, this is a textbook deserialization attack — the same class of vulnerability we routinely find in Java-based enterprise applications. The twist is the target: FMC isn't some forgotten internal app. It's the nerve center of Cisco's firewall infrastructure, often sitting on management networks that security teams assume are "safe" because they're segmented from production.

The Attack Chain: What Interlock Actually Did

Per The Hacker News and Help Net Security, Interlock began exploiting CVE-2026-20131 on January 26, 2026 — a full 36 days before Cisco disclosed and patched the vulnerability in early March. Here's the reconstructed attack chain:

Initial access: Interlock identified internet-exposed Cisco FMC management interfaces. Despite security best practices recommending these stay off the public internet, many organizations expose them — sometimes intentionally for remote management, sometimes through misconfigurations.
Exploitation: A crafted serialized Java object sent to the FMC web interface bypassed authentication entirely and executed arbitrary code as root. No phishing, no credential stuffing, no social engineering — just a direct HTTP request.
Persistence and pivoting: With root on FMC, Interlock had the keys to the kingdom. FMC stores firewall configurations, credentials for managed devices, network topology maps, and VPN settings. This is exactly the kind of foothold that turns a single vulnerability into a full network compromise.
Ransomware deployment: From their privileged position on the management network, Interlock deployed ransomware across victim environments. The same week, the group also hit Goodwill Industries, per breach tracking data.

Why Pentesters Should Care: The Management Plane Is the New Perimeter

This incident highlights a gap that many penetration testers already know exists but rarely get to test: the security of security infrastructure itself. During a typical engagement, we assess web apps, APIs, Active Directory, maybe cloud configs. How often does the scope include the firewall management console, the SIEM admin panel, or the EDR management server?

Almost never. And that's exactly what attackers like Interlock are counting on.

The management plane — the interfaces used to configure and monitor security tools — is often the most privileged and least tested surface in an enterprise. It sits on "trusted" network segments with broad access to production systems. A vulnerability here doesn't just give you a foothold; it gives you the ability to disable defenses, modify firewall rules to allow lateral movement, and extract credentials for every managed device.

Java deserialization vulnerabilities in particular are a pentester's bread and butter. Tools like ysoserial have made exploitation straightforward for years. When we find a Java-based management interface during an engagement, insecure deserialization is one of the first things we check. Interlock clearly applied the same methodology — at scale, against production targets, 36 days before anyone could stop them.

The Broader Pattern: Interlock Is Getting Smarter

Interlock isn't a newcomer. This is the same group that was spotted exploiting a Cisco FMC zero-day, and the same week they hit Goodwill Industries. Their operational tempo is accelerating: identify high-value management infrastructure, find or acquire zero-days for it, and move fast while defenders have no patch to deploy.

This also fits a broader trend in 2026. Per CrowdStrike's March Patch Tuesday analysis, attackers are increasingly targeting network appliances and management consoles rather than endpoints. Why fight through EDR on every workstation when you can own the device that manages the firewalls? Per CISA's KEV catalog, the velocity of actively exploited vulnerabilities in infrastructure products (F5 BIG-IP, Citrix NetScaler, Ivanti EPMM, Cisco FMC) has been relentless this quarter.

What to Do About It

Patch CVE-2026-20131 immediately. If you run Cisco FMC, this is a P0. Check Cisco's advisory for affected versions and apply the update now. Then audit FMC logs from January 26 onward for any signs of exploitation — unauthorized logins, configuration changes, new admin accounts.
Get your management interfaces off the internet. FMC, Panorama, FortiManager, your SIEM console — none of these should be reachable from the public internet. Use jump boxes, VPN with MFA, or zero-trust network access. If remote management is required, put it behind a well-configured reverse proxy with certificate-based authentication.
Include security tooling in your pentest scope. Next time you define a pentest engagement, explicitly add the management interfaces for your firewalls, EDR, SIEM, and identity providers. If your pentester hasn't tested your FMC console, you don't actually know if it's secure.
Monitor your management network separately. Your security tools monitor production — but who monitors the security tools? Deploy independent logging and alerting on management plane activity. If someone gets root on your FMC, you want to know from a source that FMC itself can't suppress.
Assume pre-patch exploitation on critical infrastructure CVEs. Interlock had 36 days of undetected access. When a CVSS 10.0 drops for any management product you run, don't just patch — investigate. Run a compromise assessment looking for indicators from the period between first exploitation and patch availability.