CISA Adds CVE-2026-20131 to KEV Catalog: Cisco FMC/SCC Deserialization Risk

CISA added CVE-2026-20131 to the Known Exploited Vulnerabilities Catalog on March 19, 2026, citing evidence of active exploitation. The issue affects Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management and is described as a deserialization of untrusted data vulnerability. CISA also reiterated that the KEV Catalog is a living list of actively exploited CVEs and that, under BOD 22-01, FCEB agencies must remediate listed vulnerabilities by the due date; it further urges all organizations to prioritize KEV remediation.
If you want, I can also help turn this into a short news blurb, executive summary, or patch-priority note.

---

Source: CISA CISA Adds One Known Exploited Vulnerability to Catalog | CISA