CVE-2026-20343 describes a security flaw in a critical API of Cisco Secure FMC Software that does not require authentication. An unauthenticated remote attacker can exploit this by repeatedly invoking the API to download sensitive files that should be restricted and to consume disk space without limits. This can lead to the device becoming unresponsive due to resource exhaustion, resulting in a denial-of-service condition. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function).

The vulnerability allows unauthorized access to sensitive files and unbounded disk space consumption, which can cause the affected device to become unresponsive, resulting in a denial-of-service (DoS) condition. There is no indication of confidentiality or integrity impact beyond file download, and no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Cisco's advisories for updates. Until a fix is available, restricting network access to the vulnerable API and applying compensating controls may reduce exposure.