Cisco FMC Zero-Day Exploited by China APT in Active Campaign

Amazon Threat Intelligence identified an active campaign exploiting a critical Cisco Firewall Management Center vulnerability (CVE-2026-20131, CVSS 10.0) attributed to a Chinese APT. The flaw was exploited as a zero-day since January 26 before public disclosure, with Interlock ransomware deployed as a secondary payload. The campaign targets enterprise network management infrastructure.