Cisco Patches Secure Workload Flaw That Could Grant Unauthenticated Site Admin Access
Summary
Cisco patched CVE-2026-20223, a maximum-severity Secure Workload flaw that could let unauthenticated attackers gain Site Admin privileges, expose sensitive data, and change configurations across tenant boundaries. Cisco reports no known in-the-wild exploitation.
Key points
- Cisco says insufficient validation and authentication in internal REST API endpoints could allow crafted requests from unauthenticated attackers.
- Successful exploitation could expose sensitive information and enable configuration changes across tenant boundaries with Site Admin privileges.
- Cisco says there are no workarounds; the issue is fixed in its SaaS deployment and software updates are available for on-premises customers.
- Fixed releases are 3.10.8.3 and 4.0.3.17; customers on version 3.9 or earlier must migrate to a fixed release.
- Cisco PSIRT reported no evidence of exploitation in the wild before the advisory was published.
Article Details
- Vulnerability Types
- Insufficient validation and authentication in internal REST API endpoints
- Severity
- Maximum severity; CVSS score not stated
- Affected Versions
- Cisco Secure Workload 3.9 and earlier
- Cisco Secure Workload 3.10
- Cisco Secure Workload 4.0
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-20182Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN ManagerEarlier this month, Cisco warned that another maximum severity authentication bypass vulnerability (CVE-2026-20182) affecting its Catalyst SD-WAN software-based networking platform was being actively exploited as aCVE-2026-20223Cisco · Secure workloadCisco has released fixes for CVE-2026-20223, a maximum-severity Secure Workload flaw that could let unauthenticated attackers obtain Site Admin privileges through crafted REST API requests.