Cisco Patches CVSS 10.0 Secure Workload Flaw Allowing Cross-Tenant Data Access
Summary
Cisco patched CVE-2026-20223, a CVSS 10.0 flaw in Secure Workload REST API endpoints that could let unauthenticated remote attackers read sensitive data and change configurations across tenants. Cisco reports no evidence of exploitation.
Key points
- CVE-2026-20223 stems from insufficient validation and authentication when accessing REST API endpoints; exploitation requires a crafted API request to an affected endpoint.
- A successful exploit could allow an unauthenticated remote attacker to read sensitive information and make configuration changes across tenant boundaries with Site Admin privileges.
- The flaw affects Cisco Secure Workload Cluster Software on SaaS and on-prem deployments, regardless of device configuration.
- Cisco says there are no workarounds and recommends moving from version 3.9 or earlier to a fixed release; fixes are available in 3.10.8.3 and 4.0.3.17.
- Cisco found the vulnerability during internal security testing and says it has no evidence of in-the-wild exploitation.
- The article separately notes that CVE-2026-20182, an authentication bypass in Catalyst SD-WAN Controller, was exploited by UAT-8616. This is a distinct vulnerability.
Article Details
- Vulnerability Types
- Insufficient validation and authentication in REST API endpoints
- Authentication bypass
- Severity
- CVSS 10.0 (maximum severity)
- Affected Versions
- Cisco Secure Workload Cluster Software Release 3.9 and earlier
- Cisco Secure Workload Cluster Software Release 3.10
- Cisco Secure Workload Cluster Software Release 4.0
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-20182Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN Manager#CiscoSecureWorkloadCVE-2026-20223Cisco · Secure workloadCisco has released fixes for CVE-2026-20223, a maximum-severity flaw in Secure Workload that could let an unauthenticated remote attacker access sensitive data and alter configurations across tenant boundaries.
Threat Actors
Vendors
Products
Cisco Catalyst SD-WAN ControllerThe disclosure follows Cisco’s report of another critical authentication bypass in Catalyst SD-WAN Controller, which was exploited by UAT-8616.Secure WorkloadCisco has released fixes for CVE-2026-20223, a maximum-severity flaw in Secure Workload that could let an unauthenticated remote attacker access sensitive data and alter configurations across tenant boundaries.