Cisco Secure FMC EUVD-2026-81141

Exploitation requires valid credentials for an FMC user account with at least the Security Analyst (read-only) role - this is the primary limiting factor and confirms authenticated access (PR:L). Beyond authentication, no special non-default configuration is described: the vulnerable file download API is a standard feature, and the attacker only needs network reachability to the FMC HTTPS management interface plus the ability to send a crafted request with a manipulated, unsanitized file reference. No user interaction and no elevated admin privileges are needed, which makes the low-privilege bar the key realistic constraint defenders should weigh.

This is a genuine but bounded confidentiality issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) is internally consistent with the description: network-reachable HTTPS API, low complexity, and a low-privilege authenticated requirement - Cisco explicitly states the attacker needs valid credentials for at least a Security Analyst (read-only) role, which matches PR:L. Impact is strictly confidentiality (C:H, I:N/A:N): arbitrary file download with no write or availability effect. The S:C scope change is defensible because reading arbitrary OS-level files reaches beyond the download API's intended authorization boundary. No public signals elevate urgency: there is no CISA KEV listing, no public exploit code, and no EPSS score provided, so exploitation status is 'no public exploit identified at time of analysis.' The main risk driver is that a read-only analyst - a relatively low bar in a multi-operator SOC - could exfiltrate sensitive files (credentials, keys, configs) from the firewall management plane, which manages downstream FTD devices. Net: prioritize patching because FMC is high-value infrastructure and the privilege bar is low, but this is not a wormable unauthenticated RCE.

An attacker who holds (or phishes/reuses) a low-privilege Security Analyst read-only FMC account sends a crafted HTTPS request to the vulnerable file download API, manipulating the user-controlled file reference to point at files outside their authorized scope. Because user input is not sanitized, the server returns arbitrary files - potentially configuration, credential, or key material from the management appliance. No public proof-of-concept exploit is currently identified.