CVE-2026-20343: Cisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service Vulnerability
A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeatedly invoking the API. A successful exploit could allow the attacker to download sensitive files that should be restricted and consume disk space so the device could become unresponsive, causing a DoS condition.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated remote attacker can exploit it over the network. No privileges or user interaction are required.
What could an attacker do?
An attacker could download sensitive files that should be restricted and repeatedly invoke the affected API to consume unbounded disk space. Disk exhaustion can make the device unresponsive, causing a denial-of-service condition.
What is required to trigger the denial of service?
The attacker needs to repeatedly invoke the unauthenticated critical API. The vulnerability is attributed to the API lacking authentication.