CVE-2026-20342
Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability
Description
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
Weakness: CWE-639
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Secure Firewall Management Center Check your version | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Secure Firewall Management Center (FMC)
Vendor advisory
cisco-sa-fmc-mulivulns-4PsnFwvx
Cisco Secure Firewall Management Center Software Vulnerabilities
Cisco’s rating: Critical (advisory CVSS 9.1) · Published Sep 16, 2026
Bug IDs: CSCwu16954 , CSCwu24501 , CSCwu27275 , CSCwu36643 , CSCwu42586
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from