INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Cisco Addresses 48 Firewall Vulnerabilities with Two High-Severity Flaws

| 2026-03-06 11:33 HIGH HIGH VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
On March 6, 2026, Cisco issued security updates addressing dozens of vulnerabilities affecting its firewall platforms, including Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Management Center. Nation-state actors are particularly targeted in telecom providers, government networks, and critical infrastructure due to the access and surveillance opportunities provided by these systems. The two most serious issues, CVE-2026-20079 and CVE-2026-20131, involve an authentication bypass flaw and insecure deserialization within the product's web-based management interface, respectively. These vulnerabilities affect Cisco Secure Firewall Management Center software, with a maximum CVSS score of 10 for each, impacting approximately 48 firewall platforms across various industries. The attack works by exploiting these weaknesses through specially crafted HTTP requests or malicious serialized Java objects, allowing attackers to run scripts or commands that grant root-level access to the system and potentially escalate privileges to root. As of now, there are no temporary fixes available for these vulnerabilities; organizations must upgrade to patched software versions listed in Cisco's advisory as soon as possible.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-20131, CVE-2026-20127 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-20131CVE-2026-20131 CVE-2026-20127CVE-2026-20127 CVE-2026-20079CVE-2026-20079
Target & Sectors
CN
Incident Timeline
‎2026/03/06
Threat actors exploited a zero-day vulnerability in Cisco's Secure SD-WAN, CVE-2026-20127, to conduct targeted attacks.
infrastructure Ivanti
It came from incident response data showing nation-state groups using Cisco, Fortinet, Palo Alto, Ivanti, and Juniper devices as their primary initial access vector for two consecutive years," Hogue-Spears says.
Tactical Metrics
Metrics
infrastructure
​Ivanti
Affected Product
It came from incident response data showing nation-state groups using Cisco, Fortinet, Palo Alto, Ivanti, and Juniper devices as their primary initial access vector for two consecutive years," Hogue-Spears says.
Intelligence Sources
HackRead 2026-03-06
Dark Reading 2026-03-05