CVE-2026-20223
Unauthenticated REST API Access in Cisco Secure Workload
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | secure_workload | to 3.10.8.3 (exc) |
| cisco | secure_workload | to 4.0.3.17 (exc) |
| cisco | secure_workload | 3.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20223 is a critical vulnerability in Cisco Secure Workload that allows unauthenticated, remote attackers to access internal REST APIs with Site Admin privileges due to insufficient validation and authentication.
An attacker can exploit this vulnerability by sending a specially crafted API request to an affected endpoint, which could allow them to read sensitive information and make configuration changes across tenant boundaries.
This affects both SaaS and on-premises deployments of Cisco Secure Workload Cluster Software, including certain versions prior to fixed releases.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows an unauthenticated remote attacker to gain Site Admin privileges.
- The attacker could read sensitive data across tenant boundaries.
- The attacker could make unauthorized configuration changes.
Such unauthorized access and control could compromise the confidentiality, integrity, and availability of your systems and data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, customers should upgrade Cisco Secure Workload to the fixed software versions released by Cisco.
- Upgrade to versions later than 3.10.8.3 if using 3.10.
- Upgrade to versions later than 4.0.3.17 if using 4.0.
- For SaaS deployments, no user action is required as remediation has already been applied.
There are no available workarounds, so applying the updates is the only effective mitigation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated, remote attackers to access sensitive information and make configuration changes with Site Admin privileges, which could lead to unauthorized data exposure and modification.
Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls on data confidentiality, integrity, and access.
Organizations using affected versions of Cisco Secure Workload should apply the fixed software updates promptly to mitigate risks and maintain compliance.