CVE-2026-20343: Cisco Secure FMC Auth Bypass Vulnerability

CVE-2026-20343 Overview

Cisco Secure Firewall Management Center (FMC) Software contains a missing authentication flaw in a critical API endpoint. An unauthenticated, remote attacker can invoke the API over the network to download sensitive files that should be access-restricted. Repeated invocation of the same API also consumes unbounded disk space on the device, which can render the FMC unresponsive and produce a denial-of-service (DoS) condition.

The vulnerability is classified under CWE-306: Missing Authentication for Critical Function. Cisco documented the issue in its published security advisory.

Critical Impact
An unauthenticated remote attacker can exfiltrate restricted files from Cisco Secure FMC and exhaust disk space, causing a DoS on the management plane that oversees enterprise firewall policy.

Affected Products

Cisco Secure Firewall Management Center (FMC) Software
Refer to the Cisco Security Advisory for the specific fixed release trains
Deployments exposing the FMC management API to untrusted networks

Discovery Timeline

2026-09-16 - CVE-2026-20343 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-20343

Vulnerability Analysis

The flaw resides in a critical API exposed by Cisco Secure FMC Software. The API does not enforce authentication before servicing requests. An attacker with network reachability to the FMC can issue requests directly to the endpoint without credentials, session tokens, or client certificates.

Two distinct impacts result from a single defect. First, the API returns files that policy intends to restrict to authenticated administrators. Second, each invocation triggers server-side processing that writes to disk without an upper bound. Sustained requests fill the underlying filesystem and starve legitimate management operations.

Because FMC administers Cisco firewall estates, degraded availability of the management plane blocks policy pushes, event correlation, and operator response workflows.

Root Cause

The root cause is a missing authentication check on a critical function [CWE-306]. The API handler processes requests before validating caller identity, and it lacks resource governance to cap per-request or per-client disk consumption. The two issues compound: unauthenticated access removes the identity boundary, and unbounded storage growth removes the availability boundary.

Attack Vector

Exploitation requires only network access to the FMC API. No user interaction, credentials, or prior foothold are required. An attacker sends crafted HTTP(S) requests to the vulnerable endpoint to retrieve files, or issues the request in a loop to force disk exhaustion. The attack does not affect confidentiality of user data on managed firewalls directly, but exposes FMC-resident artifacts and disrupts management availability.

No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been recorded at publication.

Detection Methods for CVE-2026-20343

Indicators of Compromise

Sustained unauthenticated HTTP(S) requests to the FMC management API from a single or small set of source IP addresses
Rapid growth of FMC disk utilization without a corresponding policy deployment or backup operation
FMC health alerts reporting low free space, failed writes, or unresponsive services
Web server access logs showing repeated 200 responses to API paths without a preceding authentication exchange

Detection Strategies

Baseline normal FMC API traffic patterns and alert on volume spikes from non-administrative source addresses
Correlate FMC disk-utilization telemetry with API request rates to surface resource-exhaustion attempts
Inspect access logs for requests to the API endpoints identified in the Cisco Security Advisory

Monitoring Recommendations

Forward FMC system, audit, and web server logs to a centralized analytics platform for retention and query
Monitor filesystem free-space thresholds on FMC appliances and trigger alerts before exhaustion impairs operations
Track authentication outcomes on the management interface and flag successful API responses without an authenticated session
Alert on new inbound connections to FMC management ports from outside the designated administrative network

How to Mitigate CVE-2026-20343

Immediate Actions Required

Apply the fixed Cisco Secure FMC Software release identified in the Cisco Security Advisory
Restrict network access to the FMC management interface to trusted administrative subnets using firewall ACLs
Verify current disk utilization on all FMC instances and free space before an attacker can exhaust it
Review access logs for the vulnerable API endpoint for signs of prior unauthenticated invocation

Patch Information

Cisco has published fixed software releases for Secure FMC Software. Consult the Cisco Security Advisory for the specific patched versions and upgrade guidance. Cisco advisories are the authoritative source for fixed-release mapping; do not rely on version inference.

Workarounds

Place the FMC management interface behind a dedicated management VLAN unreachable from user or internet-facing networks
Enforce source-IP allowlists on upstream firewalls or load balancers fronting the FMC API
Rate-limit inbound requests to the FMC management interface to blunt disk-exhaustion attempts until patching completes
Monitor and alarm on disk usage above conservative thresholds so operators can intervene before service loss

bash

# Example: restrict FMC management access at an upstream Cisco firewall
# Replace addresses with your administrative subnet and FMC IP
object-group network FMC_ADMINS
 network-object 10.10.10.0 255.255.255.0
object network FMC_HOST
 host 192.0.2.25
access-list FMC_MGMT extended permit tcp object-group FMC_ADMINS object FMC_HOST eq https
access-list FMC_MGMT extended deny   tcp any                       object FMC_HOST eq https
access-group FMC_MGMT in interface outside