31 High-Impact Vulnerabilities Exploited in March as Interlock

March 2026 proved a highly active month for vulnerability exploitation, standing out as one of the year’s most significant periods for observed threats.

Security researchers tracked 31 high-impact vulnerabilities that were actively used against real-world systems, touching products from more than 20 major vendors including Cisco, Microsoft, Google, Apple, Langflow, ConnectWise, Citrix, and others.

Among those vendors, Microsoft and Apple together accounted for roughly 32% of the affected products, reinforcing how widely used platforms continue to draw the heaviest targeting from threat actors.

Of the 31 vulnerabilities identified this month, 29 carried a “Very Critical” Recorded Future Risk Score, meaning the probability of exploitation was already high at the time of discovery.

Attackers did not wait long, as the every single one of these vulnerabilities saw active exploitation during March, a pace that gives security teams very little room to respond.

What makes this month stand out even further is the presence of a zero-day at the center of one of the most damaging campaigns tracked in recent months — one that targeted a widely deployed Cisco network security platform before a patch was even available.

One of the most striking data points in this month’s landscape is the inclusion of CVE-2017-7921, a vulnerability affecting Hikvision that is approximately nine years old.

Attackers are still actively exploiting it in environments where patching has never happened. That detail alone tells a larger story about the real state of vulnerability management across enterprises: age does not reduce risk when systems remain unpatched and exposed.

Defenders should never dismiss an older CVE based on its date alone — what matters is whether it can still be reached and exploited.

Recorded Future analysts identified all 31 vulnerabilities and noted that ten of them had publicly available proof-of-concept (PoC) exploits at the time of discovery.

Insikt Group also created Nuclei templates for two new high-severity vulnerabilities this month — a path traversal flaw in MindsDB (CVE-2026-27483) and a critical missing authentication issue in Nginx UI (CVE-2026-27944) — as part of their ongoing effort to help security teams test exposure quickly.

A previously published template for CVE-2025-68613 in n8n was already in circulation in December before attackers began using it in March.

Two vulnerabilities stood out in terms of linkage to organized threat actor activity. Nine of the 31 CVEs enabled remote code execution across products from Google, Langflow, Craft CMS, Laravel, Microsoft, n8n, SolarWinds, and Apple.

Additionally, two vulnerabilities and a multi-component exploit kit were directly connected to active malware campaigns, including a sophisticated iOS full-chain exploit called DarkSword that delivered the GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE payloads.

However, the most consequential event this month centered on the Interlock Ransomware Group and a zero-day in Cisco’s Secure Firewall Management Center.

Interlock’s Exploitation of CVE-2026-20131

The Interlock Ransomware Group’s exploitation of CVE-2026-20131 began on January 26, 2026 — weeks before Cisco published its security advisory on March 4.

This means the group had been operating inside enterprise networks using a vulnerability that defenders had no official patch or public knowledge of at the time.

The flaw exists in Cisco’s Secure Firewall Management Center (FMC), a centralized platform used by administrators to manage firewall policies, monitor network security events, and control device configurations across enterprise environments.

The vulnerability is classified as a critical deserialization of untrusted data issue (CWE-502) and carries a Recorded Future Risk Score of 99 — the highest possible.

The attack mechanism is straightforward but highly effective. An unauthenticated threat actor sends a specially crafted HTTP request to the FMC web-based management interface.

Since the platform fails to properly validate user-supplied Java byte streams, the attacker can inject a serialized Java object that the application processes and executes as root-level code.

The attacker then pulls a malicious ELF binary from a staging server at 37[.]27[.]244[.]222 to support follow-on operations inside the network.

Once inside, the Interlock group uses custom Java- and JavaScript-based remote access trojans (RATs), a memory-resident web shell, and proxy infrastructure to stay hidden and move across the network.

Post-compromise activity includes active reconnaissance, data collection, lateral movement, and the use of legitimate tools such as ConnectWise ScreenConnect, Volatility, and Certify for credential theft and privilege escalation. 

The end goal of these operations is ransomware deployment, but the initial foothold through the FMC zero-day is what makes the campaign so dangerous — network security infrastructure itself becomes the entry point.

On March 11, 2026, a GitHub user shared an alleged PoC for CVE-2026-20131. That PoC uses the open-source tool ysoserial to generate a malicious Java-serialized payload, submits it to candidate endpoints that accept serialized Java data, and interprets an HTTP 500 response as confirmation that deserialization triggered command execution.

Insikt Group has not tested this PoC for accuracy or confirmed its reliability, and vulnerability management teams should exercise caution before testing any PoC in a production or staging environment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.