CVE-2026-20342

Cisco Secure FMC (the management center for Cisco Secure Firewall/Firepower deployments) contains a flaw in a specific file download API where user input is not sanitized, allowing arbitrary file downloads from the appliance. An authenticated, remote attacker can trigger it with a single crafted HTTPS request, provided they hold valid credentials for an account with at least the read-only Security Analyst role, so it is primarily an insider or compromised-account risk. A successful exploit exposes any file on the system, which on an FMC can include configuration data, certificates, and other secrets, with no impact on integrity or availability (CVSS 7.7, high confidentiality impact, scope changed). Any organization running Cisco Secure FMC Software is affected; the source data does not specify version ranges. As of now there is no known exploitation, no public proof-of-concept, and the flaw is not in CISA's KEV catalog.

What to do: Upgrade FMC to a fixed release as specified in Cisco's security advisory, and in the meantime restrict access to the FMC web interface to trusted management networks. Audit which accounts hold the Security Analyst role or higher, since any such credential is sufficient to exploit, and monitor HTTPS traffic to file download API endpoints for requests containing unexpected file paths.