{"id":"CVE-2026-20343","title":"A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space.\r\n\r\nThis vulnerability exists because a critical API lacks authentic…","summary":"A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space.\r\n\r\nThis vulnerability exists because a critical API lacks authentic…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-306"],"vendor":"Cisco","product":"Cisco Secure Firewall Management Center (FMC)","affected":["secure_firewall_management_center_fmc 7.3.0","secure_firewall_management_center_fmc 7.3.1","secure_firewall_management_center_fmc 7.3.1.1","secure_firewall_management_center_fmc 7.4.0","secure_firewall_management_center_fmc 7.4.1","secure_firewall_management_center_fmc 7.4.1.1","secure_firewall_management_center_fmc 7.3.1.2","secure_firewall_management_center_fmc 7.6.0","secure_firewall_management_center_fmc 7.4.2","secure_firewall_management_center_fmc 7.4.2.1","secure_firewall_management_center_fmc 7.7.0","secure_firewall_management_center_fmc 7.4.2.2","secure_firewall_management_center_fmc 7.6.1","secure_firewall_management_center_fmc 7.4.2.3","secure_firewall_management_center_fmc 7.6.2","secure_firewall_management_center_fmc 7.7.10","secure_firewall_management_center_fmc 7.6.2.1","secure_firewall_management_center_fmc 7.7.10.1","secure_firewall_management_center_fmc 7.4.2.4","secure_firewall_management_center_fmc 7.4.3","secure_firewall_management_center_fmc 7.6.3","secure_firewall_management_center_fmc 7.7.11","secure_firewall_management_center_fmc 7.6.4","secure_firewall_management_center_fmc 10.0.0","secure_firewall_management_center_fmc 7.4.4","secure_firewall_management_center_fmc 7.4.5","secure_firewall_management_center_fmc 7.7.12","secure_firewall_management_center_fmc 7.6.5","secure_firewall_management_center_fmc 7.4.6","secure_firewall_management_center_fmc 10.0.1","secure_firewall_management_center_fmc 7.4.7"],"published":"2026-09-16","updated":"2026-09-18","sourceUpdated":"2026-09-18T15:17:07.577","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20343","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx","label":"psirt@cisco.com"},{"url":"https://software.cisco.com"}],"tags":["nvd","cve.org","csaf","vendor-advisory","cisco"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-18T14:39:35.675985Z"},"epss":0.0045,"epssPercentile":0.3837,"ingestedAt":"2026-09-16T16:37:52.202Z","slug":"CVE-2026-20343","body":"## Overview\n\nA vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space.\r\n\r\nThis vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeatedly invoking the API. A successful exploit could allow the attacker to download sensitive files that should be restricted and consume disk space so the device could become unresponsive, causing a DoS condition.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **cisco-sa-fmc-mulivulns-4PsnFwvx** · Cisco · affected: Cisco Secure Firewall Management Center (FMC) Appliances · updated 2026-09-16 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-mulivulns-4PsnFwvx)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}