Cisco FMC and CVE-2026-20131: Interlock Had 36 Days of Zero-Day

Here's my take: 36 days is not a patch cycle for an actively exploited unauthenticated RCE. It's an invitation. And Cisco sent it.

CVE-2026-20131 is a critical-severity (CVSS 9.8) remote code execution vulnerability in the REST API of Cisco Firepower Management Center (FMC). No credentials required. A single malformed HTTP request to the /api/fmc_config/v1/ endpoint gets an attacker root shell on the FMC server. That's the entire attack chain.

If you're not familiar with FMC's role in a Cisco security stack: it's the central management console from which security teams control every Cisco FTD (Firepower Threat Defense) sensor deployed across the network. Dozens or hundreds of them in enterprise environments. Compromising the FMC doesn't give you a foothold in one system. It gives you the keys to your target's entire security visibility layer — and the ability to quietly rewrite the rules.

The Timeline Cisco Didn't Headline

Thirty-six days. From internal confirmation of active exploitation to public patch. During that window, Cisco issued no provisional security advisory, no indicators of compromise, no direct customer notifications to organizations with internet-exposed FMC instances.

I've been covering enterprise security for years. This is not how responsible disclosure looks when exploitation is already active. Fortinet patched CVE-2024-21762 (FortiOS SSL-VPN, active exploitation) in under 5 days. Palo Alto published a provisional advisory with IoCs within 48 hours for CVE-2024-3400. Cisco went dark for 36 days. For a vendor doing $14B annually in network security, that's not an oversight — it's a policy choice, and a bad one.

Interlock: Who They Are and What They Did With 36 Days

Interlock isn't a new name. First documented by Unit 42 in September 2023, the group operates as a RaaS (Ransomware-as-a-Service) outfit with a clear focus on critical infrastructure: healthcare, manufacturing, financial services. Their playbook combines double extortion — encryption plus pre-exfiltration of data — with dwell times of 8 to 21 days before the final ransomware payload drops.

Let's be real: CVE-2026-20131 wasn't the endgame. It was the perfect initial access vector for everything that follows.

A compromised FMC gives an attacker four simultaneous critical capabilities:

1. Complete network inventory: FMC maintains an updated map of every asset managed by FTD sensors — hosts, applications, inter-segment traffic. It's literally the victim's infrastructure inventory.
2. Silent firewall policy modification: with shell on FMC, an attacker can create allow-all rules, disable IPS signatures, open exfiltration channels — none of which will trigger alerts in the compromised FMC itself.
3. Pivoting through the management channel: FMC-to-FTD sensor communication uses mutual certificates. With a compromised FMC, that authenticated management channel can deliver payloads to the sensors themselves.
4. Hard-to-detect persistence: FMC maintains audit logs of policy changes — but if the attacker controls the FMC, they control the audit logs.

Cisco Talos documented three confirmed incidents between February 14 and March 22, 2026. In two confirmed cases, Interlock's ransomware payload was deployed via the compromised FMC against Windows servers on the same network. One incident showed a nine-day dwell period before encryption — more than enough time to complete a full data exfiltration.

4,200 FMC Instances Exposed: A Problem That's Been There for Years

Shodan and Censys data from March 20, 2026 shows approximately 4,200 Cisco FMC instances with port 443 directly exposed to the public internet — no bastion host, no VPN, no perimeter firewall in between.

That number should be zero. Cisco's FMC hardening guide — available since FMC 6.0 — explicitly states that FMC should not be directly internet-facing. That's not a recommendation. It's the only secure architecture for a central security management plane.

The fact that 4,200 instances are misconfigured in 2026 tells you either that teams aren't reading the hardening documentation, or that operational constraints prevent them from following it. Either way, during these 36 days, 4,200 attack surfaces had no published mitigation.

Immediate Actions — In Priority Order

Patch. FMC 7.2.9 or FMC 7.4.2. No ambiguity. Affected versions are 7.2.0 through 7.2.8 and 7.4.0 through 7.4.1. This is an in-place upgrade — estimated 45 to 90 minutes depending on sensor count.

If your change management process prevents an immediate patch window, these are your interim risk reducers:

1. Isolate FMC from the internet behind a jump host with MFA or through VPN. If it's currently directly exposed, this is your highest-impact immediate action.
2. Source IP restrictions at your perimeter firewall for port 443 to FMC — limit to your management network ranges only.
3. Monitor Cisco Talos IoCs: the initial Interlock payload hashes and C2 IP ranges are published in the March 22 technical advisory.
4. Audit your FMC audit log: if you have instances that may have been exposed during February 14–March 22, check specifically for unauthorized policy changes and unexpected API access patterns.

The cost of patching a 30-to-50 sensor FMC environment — including change management preparation, maintenance window, and regression testing — runs $8K–$15K in internal hours and partial downtime. The Ponemon Institute's 2025 Cost of a Data Breach Report puts the average ransomware incident cost in critical infrastructure at $4.7M. That math is not complicated.

The elephant in the room is what this incident says about Cisco as a security vendor. They sell enterprise organizations on the premise that their defenses are in capable hands. Thirty-six days of silence while a ransomware group uses your flagship management platform as an initial access vector is not consistent with that premise. Enterprise customers on support contracts deserved a notification — under NDA if necessary — before March 22. That they didn't get one is a vendor relationship problem, not just a technical one.

If you ask me directly: if you're running an affected FMC version, there is no defensible reason to have this patch outside your current sprint. Change management friction is not an acceptable answer when active exploitation is documented and a group like Interlock knows that vector remains open in many organizations.

I've seen this movie before. The CVE gets published, vendors issue statements about "responsible disclosure timelines," and six months later the post-mortems confirm that organizations patched too slowly. The difference this time is that 36 days of silence wasn't a technical constraint — it was a decision. Enterprise buyers should factor that into their next renewal conversation.