Cisco Patches Critical Secure Workload Vulnerability Allowing Site Admin Access
Summary
Cisco patched CVE-2026-20223, a critical Secure Workload REST API flaw that could allow Site Admin access and cross-tenant data reading and configuration changes. Cisco also patched three medium-severity flaws in other products.
Key points
- CVE-2026-20223 has a CVSS score of 10.0 and stems from insufficient validation and authentication in internal REST API endpoints.
- A crafted API request could enable attackers to access site resources with Site Admin privileges, read sensitive information, and modify configurations across tenant boundaries.
- The flaw affects Secure Workload Cluster Software on SaaS and on-premises deployments; the web-based management interface is not affected.
- Cisco fixed the vulnerability in Secure Workload versions 3.10.8.3 and 4.0.3.17 and recommends updating.
- Cisco says it is not aware of exploitation of CVE-2026-20223 in the wild.
- Cisco also patched three medium-severity vulnerabilities affecting ThousandEyes appliances and agents, and Nexus 3000 and 9000 switches; the reported impacts include remote command execution and BGP-related denial of service.
Article Details
- Vulnerability Types
- Insufficient validation and authentication in internal REST API endpoints
- Severity
- Critical (CVSS 10/10)
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available