CVE-2026-20342: high-severity vulnerability in Cisco Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.6%
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system.
This vulnerability exists because user input is not being sanitized. An attacker could exploit this vulnerability by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from the affected system.
To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Cisco · Cisco Secure Firewall Management Center (FMC)Related CVEs — Cisco Secure Firewall Management Center (FMC)
In the same product, most dangerous first.
CVE-2026-20079CRITICALCisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityEPSS 88.7%KEVCVE-2026-20131CRITICALCisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityEPSS 44.4%KEVCVE-2026-20316MEDIUMCisco Secure Firewall Management Center Software Static Credential VulnerabilityEPSS 35.1%KEVCVE-2026-20242CRITICALCisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-20340HIGHCisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution VulnerabilityEPSS 0.7%CVE-2026-20343HIGHCisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service VulnerabilityEPSS 0.7%