# Cisco Secure Workload Suffers CVSS 10.0 REST API Bypass Allowing Unauthorized Cross-Tenant Data Access
## The Threat
Cisco has patched a critical authentication flaw in Secure Workload that allows unauthenticated attackers to access sensitive information and modify configurations across tenant boundaries. Tracked as CVE-2026-20223 with a maximum CVSS score of 10.0, the vulnerability stems from insufficient validation and authentication controls on REST API endpoints in both SaaS and on-premises deployments.
The flaw enables attackers to craft malicious API requests that bypass authentication mechanisms entirely, granting them the privileges of a Site Admin user. This is particularly dangerous because it doesn't require any form of credential compromise or social engineering—an attacker with network access to the API endpoint can immediately begin reading sensitive data and making unauthorized configuration changes. Cisco confirmed during its internal security assessment that the vulnerability affects all affected versions regardless of how the platform is configured.
The timing of this disclosure is significant: Cisco released this advisory just days after revealing that another maximum-severity authentication bypass (CVE-2026-20182, CVSS 10.0) in Catalyst SD-WAN Controller was already being actively exploited by threat actor UAT-8616. The convergence of two unrelated CVSS 10.0 flaws in Cisco's security portfolio within a single week suggests increasing pressure on the vendor's engineering teams and underscores the importance of rapid patching across Cisco's extensive product line.
## Severity and Impact
| Field | Value |
|-----------|-----------|
| CVE ID | CVE-2026-20223 |
| CVSS Score | 10.0 (Maximum Severity) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| CWE | CWE-287 (Improper Authentication), CWE-352 (Cross-Site Request Forgery) |
Impact Summary: An unauthenticated, remote attacker can:
## Affected Products
Cisco Secure Workload Cluster Software (all deployment models):
Both SaaS-hosted and on-premises deployments are affected equally. Device configuration does not provide any protection against exploitation.
## Mitigations
Immediate Actions:
1. Upgrade immediately to the patched versions listed above. No workarounds exist, making patching the only viable remediation.
2. For Version 3.9 and earlier: Migrate to Version 3.10.8.3 or later, or Version 4.0.3.17 or later. Extended support timelines may apply—check Cisco's support documentation for your specific release.
3. Verify deployment status: Confirm which versions of Secure Workload are running across your environment, including any disaster recovery or failover instances.
Compensating Controls (temporary, not a substitute for patching):
Post-Patch Validation:
## References
---
## HackWire Analysis
The discovery of CVE-2026-20223 during Cisco's internal security testing—combined with the concurrent active exploitation of CVE-2026-20182 in a separate Cisco product—reveals a troubling pattern: Cisco's authentication frameworks are showing systematic weaknesses across multiple product lines.
What makes this flaw particularly dangerous is the complete absence of barriers to exploitation. Unlike vulnerabilities that require specific user actions or depend on misconfiguration, this REST API bypass works against default, production deployments. The ability to impersonate a Site Admin user across tenant boundaries transforms a technical flaw into a multi-organization breach scenario. For managed service providers or enterprises with consolidated Secure Workload deployments, a single successful exploit could expose data from dozens of independent business units simultaneously.
The "no evidence of exploitation in the wild" statement offers limited reassurance. Secure Workload is primarily used by enterprise and service provider networks—organizations not typically visible in public breach disclosures. An attacker gaining Site Admin access could silently modify security policies, inject network segmentation bypasses, or establish persistent access through policy changes that would be nearly invisible to standard security monitoring. This makes the window between disclosure and patching an elevated-risk period.
Organizations should treat this as critical-priority patching—likely requiring emergency change windows and coordination with dependent systems. The existence of no workarounds means unpatched systems must be taken offline if they cannot be updated immediately. For SaaS customers, assume Cisco is patching their hosted infrastructure in parallel; verify patch status directly with your account team rather than assuming completion dates.
— HackWire Editorial
## Related Coverage