Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-20223 |
| Alert Source | Cisco Security Advisory (cisco-sa-csw-pnbsa-g8WEnuy) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-20 |
| Vendor | Cisco |
| Product | Secure Workload |
| Vulnerability Type | Authentication Bypass (Access Validation in internal REST APIs) |
| CVSS Score | 10.0 (critical — maximum score) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: Cisco Security Advisory
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access platform resources with the privileges associated with the Site Admin role. According to Cisco, successful exploitation could allow unauthorized access to administrative platform functions, potentially impacting the security of the monitored infrastructure.
CVE-2026-20223 is the most severe of the four vulnerabilities published in this Cisco security advisory — the only one classified as critical and one of the few vulnerabilities with the maximum CVSS score of 10.0.
Required Actions
Promptly update Cisco Secure Workload to vendor-supported versions containing the fix:
- 3.10.x — upgrade to 3.10.8.3 or later
- 4.0.x — upgrade to 4.0.3.17 or later
- 3.9.x and earlier — migrate to a supported branch (3.10.8.3+ or 4.0.3.17+); no standalone patches were released for these versions
Until updates are deployed, restrict network access to Secure Workload management interfaces (in particular internal REST API endpoints) to trusted administrative segments only. Monitor audit logs for unusual operations performed with Site Admin privileges and for the creation of new administrative accounts.
Who Is Affected?
This vulnerability affects the Cisco Secure Workload platform (formerly Tetration) in versions:
- 3.9.x and earlier (all)
- 3.10.x prior to 3.10.8.3
- 4.0.x prior to 4.0.3.17
Cisco Secure Workload is a microsegmentation and workload-behavior monitoring platform used in data centers and cloud environments — adopted by large organizations to enforce Zero Trust policies between applications. A compromise with Site Admin privileges gives an attacker full control over segmentation policy: they can disable protection, hide malicious traffic, or obtain visibility into the entire topology and application communication.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
