Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access
Summary: Cisco released updates for CVE-2026-20223, a CVSS 10.0 flaw in Secure Workload caused by insufficient validation and authentication on REST API endpoints, which lets an unauthenticated remote attacker read sensitive information and make configuration changes across tenant boundaries with Site Admin privileges. The flaw affects Secure Workload Cluster Software in SaaS and on-prem deployments regardless of device configuration, has no workarounds, and was found during internal security testing with no evidence of exploitation in the wild.
Bottom line: A single crafted API request reaches Site Admin privileges across tenant boundaries with no authentication and no workaround, so patching is the only mitigation. The disclosure follows a week after Cisco reported that a separate CVSS 10.0 authentication bypass in Catalyst SD-WAN Controller, CVE-2026-20182, was exploited by the threat actor UAT-8616.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20182CVE-2026-20223
- Related
- CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 14, 2026