Detect Cisco FMC/SCC Deserialization RCE Exploitation (CVE-2026-20131) in Microsoft Sentinel
Detects exploitation of CVE-2026-20131, a deserialization of untrusted data vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management. Successful exploitation allows unauthenticated or authenticated remote attackers to execute arbitrary commands on the underlying OS. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
KQL Detection Query
let suspiciousUAParts = dynamic(["java", "python-requests", "curl", "wget", "exploit"]);
let fmcPorts = dynamic([443, 8080, 8443]);
union
(
CommonSecurityLog
| where DeviceVendor == "Cisco" and DeviceProduct has_any ("Firepower", "FMC", "FireSIGHT")
| where Activity has_any ("deserialization", "java.lang.Runtime", "ProcessBuilder", "ClassLoader", "ObjectInputStream")
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, Activity, AdditionalExtensions
),
(
AzureNetworkAnalytics_CL
| where L7Protocol_s == "https" and DestPort_d in (fmcPorts)
| where FlowStatus_s == "A"
| join kind=inner (
ThreatIntelligenceIndicator
| where Active == true and NetworkIP != ""
| project ThreatIP = NetworkIP, ThreatType
) on $left.SrcIP_s == $right.ThreatIP
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, ThreatType
),
(
DeviceNetworkEvents
| where RemotePort in (fmcPorts)
| where InitiatingProcessFileName in~ ("java", "java.exe", "sh", "bash", "python", "python3")
| where RemoteUrl has_any ("fmc", "firesight", "firepower")
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
Syslog
| where SyslogMessage has_any ("deserialization", "ObjectInputStream", "ClassNotFoundException", "java.lang.Runtime.exec", "ProcessBuilder")
| where Computer has_any ("fmc", "firesight", "sfmc")
| project TimeGenerated, Computer, SyslogMessage, HostName
)
| order by TimeGenerated descDetects CVE-2026-20131 exploitation via Cisco FMC deserialization abuse. Correlates suspicious Java deserialization indicators in FMC logs, threat-intel-matched inbound connections to FMC ports, and process anomalies on FMC host systems.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Java-based administrative tools interacting with FMC API may trigger deserialization log entries
- Vulnerability scanners or pen-test tooling targeting FMC management interface
- Internal monitoring agents using Java runtimes on FMC host
Other platforms for CVE-2026-20131
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Deserialization Payload Delivery to FMC-like Endpoint
Expected signal: Network logs: POST to /j_spring_security_check with binary Content-Type. Process logs: java process spawning 'id' command. File creation event for /tmp/rce_proof.txt.
- Test 2Spawn Reverse Shell from Java Process (Post-Exploitation Simulation)
Expected signal: ProcessRollup2 event showing java parent spawning bash child. NetworkConnectIP4 event for outbound TCP to attacker IP on port 4444.
- Test 3Drop Webshell on FMC Tomcat Webroot (Post-Exploitation Persistence)
Expected signal: File creation event for .jsp file in Tomcat webroot. Syslog entry for file write by java or tomcat process user.
- Test 4Enumerate FMC Management API Without Authentication (Pre-Exploitation Recon)
Expected signal: Web server access logs showing GET/POST to /api/fmc_platform/ and /api/fmc_config/ from an external IP. 401 or 200 responses logged.
Unlock Pro Content
Get the full detection package for CVE-2026-20131 including response playbook, investigation guide, and atomic red team tests.