EUVD-2026-81141
GHSA-2784-9wmv-5cq2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTPS API, low complexity, requires read-only analyst account (PR:L); arbitrary file read beyond app scope justifies S:C and C:H, with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system.
This vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
AnalysisAI
Arbitrary file disclosure in Cisco Secure Firewall Management Center (FMC) allows an authenticated, remote attacker holding only a Security Analyst (read-only) account to download arbitrary files from the affected system by sending a crafted HTTPS request to a file download API that fails to sanitize user input. The vulnerability scores CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality impact is high and the scope change indicates the flaw crosses a security boundary between the web application and the underlying appliance filesystem, while integrity and availability are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid credentials for an FMC user account with at least the Security Analyst (read-only) role - this is the primary limiting factor and confirms authenticated access (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded confidentiality issue rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is confirmed in the available data, so the first step is to consult Cisco's advisory (cisco-sa-fmc-mulivulns-4PsnFwvx at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx), which bundles this issue with related FMC vulnerabilities, and apply the fixed software release listed there for your specific train - Cisco advisories of this type name per-train fixed builds, and upgrading to the stated fixed release is the only complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Secure Firewall Management Center deployment, confirm which version and train each runs, and pull the current Cisco security advisory for CVE-2026-20342 to confirm the affected releases and any interim guidance; simultaneously audit the FMC user directory and disable, delete, or convert to a uniquely attributable and monitored account any Security Analyst (read-only) logins that are stale, shared, service-based, or not tied to a named individual, and raise logging/monitoring on FMC file-download API calls so anomalous requests are alertable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote a
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root o
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Se
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-managemen
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Share
External POC / Exploit Code
Leaving vuln.today