Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via Internal REST API Access-Validation Flaw

Cisco Secure Workload CVE-2026-20223 (TL-2026-0548), also tracked as cisco-sa-csw-pnbsa-g8WEnuy, is a critical-severity software vulnerability scored CVSS 10, first published 2026-05-21. It has no confirmed attribution, affects Cisco Secure Workload Cluster Software, references 1 CVE (CVE-2026-20223), maps to 32 MITRE ATT&CK techniques (T1018, T1059, T1068), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0548

Threat ID
TL-2026-0548
Also known as
cisco-sa-csw-pnbsa-g8WEnuy, CSCwt99942
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-05-21
Last reviewed
2026-05-21
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
financial, government, healthcare, technology, telecommunications, managed-service-providers, critical-infrastructure, energy, manufacturing, retail
Target regions
Global, North America, Europe, Asia-Pacific, Latin America, Middle East
Detection rules
9
Indicators of compromise
15

Cisco disclosed CVE-2026-20223, a CVSS 10.0 access-validation flaw in the internal REST APIs of Cisco Secure Workload (formerly Tetration). Unauthenticated remote attackers who can reach an affected endpoint can read sensitive data and change configuration across tenant boundaries with the privileges of the Site Admin role. The SaaS deployment is already fixed; on-prem clusters must upgrade to 3.10.8.3 or 4.0.3.17 — no workarounds exist.

How Cisco Secure Workload CVE-2026-20223 works

On 2026-05-20 Cisco PSIRT published advisory cisco-sa-csw-pnbsa-g8WEnuy disclosing CVE-2026-20223, a maximum-severity (CVSS 3.1 base 10.0, Scope: Changed) vulnerability in the access-validation logic of internal REST API endpoints exposed by Cisco Secure Workload Cluster Software. The flaw is rooted in CWE-306 (Missing Authentication for Critical Function): one or more internal REST API routes fail to enforce authentication and tenancy checks, so a remote attacker who can deliver a crafted HTTP request to the cluster''s API plane can act with the privileges of the Site Admin role without supplying any credential.

Cisco Secure Workload, originally branded Tetration, is the company''s zero-trust microsegmentation and workload-protection platform. A single Secure Workload cluster typically hosts many tenant scopes that map to business units, applications, or customers; Site Admin is the top-of-tree role that owns scope creation, policy enforcement, agent management, RBAC, ingest configuration, and integrations (vCenter, AWS, Azure, Kubernetes, F5/Citrix/AVI ADCs, ServiceNow, IPAM, etc.). Site Admin compromise is therefore equivalent to taking over the customer''s entire microsegmentation control plane.

The vulnerability is reachable network-wide (AV:N, AC:L, PR:N, UI:N) and changes scope (S:C) because the affected component (the internal REST API service) is being abused to perform privileged actions in a different security authority (the per-tenant data plane and policy store). Confidentiality, Integrity and Availability are all rated High. Cisco describes the prerequisite as the ability to ''send a crafted API request to an affected endpoint'' — the advisory does not enumerate the specific endpoint paths, and Cisco has not released a PoC. CWE-306 is the same weakness class behind a long line of Cisco appliance authentication bypasses (CVE-2023-20198, CVE-2024-20418, CVE-2025-20188), and the same triage applies: assume the gap is in a path-routing or middleware layer that processes ''internal'' requests without the normal session/SSO check.

Impact for a real customer is severe. With Site Admin a successful attacker can: read every tenant''s application-dependency map, flow telemetry, and inventory (a complete network blueprint of the protected environment); modify segmentation policies to disable enforcement on any workload (enabling lateral movement deeper into the customer''s environment); push arbitrary configuration to Secure Workload agents on protected hosts (each agent runs as root/SYSTEM); pivot through the platform''s configured connectors (Azure, AWS, vCenter, ServiceNow, AD, LDAP, SAML IdPs) to siphon credentials; create new tenants, users, API keys and external roles to entrench access; and disable audit logging or retention to evade response. Because Scope is Changed, exploitation from one tenant breaks the multi-tenant boundary — managed-service providers operating shared Secure Workload clusters are exposed to cross-customer impact.

Vulnerable Products: Cisco Secure Workload Cluster Software, both SaaS and on-prem deployments, ''regardless of device configuration.'' The web-based management interface itself is not vulnerable — only the internal REST API surface. Fixed Releases: 3.9 and earlier require migration to a fixed release (no in-train fix); 3.10.x is fixed in 3.10.8.3; 4.0.x is fixed in 4.0.3.17. Cisco has already patched the SaaS deployment, so no customer action is required for SaaS-hosted tenants. The Cisco bug tracker ID is CSCwt99942.

Workarounds: None. Cisco''s advisory states explicitly ''There are no workarounds that address this vulnerability,'' so patching is the only mitigation. Compensating controls customers can apply pending an upgrade window: tighten network ACLs on the cluster management VLAN so only the documented administrator subnets and ingest sources can reach the cluster on TCP/443 and the cluster control ports; remove any internet-facing exposure of the Secure Workload UI/API (the product is intended to sit on a management network); enable HTTP request logging at the load balancer / front-end proxy and alert on requests to paths that are not part of the documented OpenAPI specification (/openapi/api/v1, /openapi/oauth, /openapi/scope, /openapi/inventory, /openapi/role, /openapi/agents, /openapi/policies); monitor Secure Workload audit logs for Site Admin actions taken outside of normal change windows or from unfamiliar source IPs.

Exploitation Status: Cisco PSIRT states no public announcements or malicious use have been observed as of advisory publication. No public PoC is available, and the bug was found internally by Cisco. However, the pattern (unauthenticated REST API auth bypass) is operationally trivial to weaponise once an attacker locates the affected endpoint — historically every CVSS 10.0 Cisco appliance bug in this class has been turned into a working exploit within days of disclosure (CVE-2023-20198 IOS-XE Web UI privilege escalation was exploited at scale within 48 hours; CVE-2024-20418 URWB and CVE-2025-20188 ASA/FTD followed similar curves). Defenders should treat the vulnerability as one that will see exploitation attempts almost immediately after a PoC drops, particularly against internet-exposed or partner-accessible Secure Workload clusters.

Detection guidance: The web-based UI is not vulnerable, so defensive instrumentation must sit at the network layer (NetFlow/IPFIX/PCAP on the cluster front-ends) and at the cluster''s reverse proxy access logs. Expect telltale patterns of (a) unauthenticated HTTP requests to API paths that should require an X-Tetration-Cookie / Bearer token, (b) Site Admin-equivalent actions (scope create/modify, agent re-key, user invite, integration add) in audit logs without a preceding authenticated login event, and (c) requests originating from non-administrative source IPs to the cluster on TCP/443 with non-browser User-Agent strings.

MITRE ATT&CK techniques used in TL-2026-0548

Discovery

T1018 Remote System Discovery; T1087.004 Account Discovery: Cloud Account; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.004 Valid Accounts: Cloud Accounts

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Defense Evasion

T1078 Valid Accounts

Lateral Movement

T1080 Taint Shared Content; T1550.001 Use Alternate Authentication Material: Application Access Token

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1098.003 Account Manipulation: Additional Cloud Roles; T1136.003 Create Account: Cloud Account

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Impact

T1491.001 Defacement: Internal Defacement; T1531 Account Access Removal; T1565.001 Data Manipulation: Stored Data Manipulation

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595 Active Scanning; T1595.002 Vulnerability Scanning

defense-impairment

T1685 Disable or Modify Tools; T1685.002 Disable or Modify Cloud Log; T1685.006 Clear Linux or Mac System Logs

Affected products and versions in Cisco Secure Workload CVE-2026-20223

  • Cisco — Secure Workload Cluster Software
    Vulnerable versions: 3.9 and earlier; 3.10 (prior to 3.10.8.3); 4.0 (prior to 4.0.3.17)
    Fixed in: 3.10.8.3; 4.0.3.17
  • Cisco — Secure Workload SaaS
    Vulnerable versions: all hosted versions prior to Cisco-side patch on 2026-05-20
    Fixed in: already patched by Cisco — no customer action required
  • Cisco — Tetration Analytics (legacy product name for Secure Workload)
    Vulnerable versions: all branches now branded as Cisco Secure Workload
    Fixed in: see Cisco Secure Workload fixed releases

Remediation for Cisco Secure Workload CVE-2026-20223

Patches

  • Cisco Secure Workload 3.10.8.3 (fixes the 3.10 train).
  • Cisco Secure Workload 4.0.3.17 (fixes the 4.0 train).
  • Cisco Secure Workload SaaS — already patched by Cisco; no customer action required.
  • Cisco bug-tracking ID: CSCwt99942.

Immediate actions

  • On-prem 3.10.x clusters: upgrade Cisco Secure Workload Cluster Software to 3.10.8.3 or later.
  • On-prem 4.0.x clusters: upgrade Cisco Secure Workload Cluster Software to 4.0.3.17 or later.
  • On-prem 3.9.x and earlier: migrate to a fixed release (no in-train fix exists for the 3.9 train).
  • SaaS deployments: no customer action required — Cisco has already patched the Secure Workload SaaS environment.
  • Restrict network access to the Secure Workload cluster management interfaces (TCP/443 and cluster control ports) to documented administrator subnets and ingest sources via L3/L4 ACLs.
  • Remove any direct internet exposure of the Secure Workload UI/API surface; the product is designed for placement on a protected management network.
  • Enable verbose HTTP request logging at the cluster front-end load balancer / reverse proxy and forward to SIEM.

Workarounds

  • None. Cisco PSIRT advisory cisco-sa-csw-pnbsa-g8WEnuy explicitly states: ''There are no workarounds that address this vulnerability.''
  • Compensating (not full) mitigations: strict network ACLs around the cluster, removal of internet exposure, request-path allow-listing at front-end proxy, enhanced audit-log monitoring.

Longer-term hardening

  • Subscribe to Cisco Security Notifications and to the cisco-sa-csw-pnbsa-g8WEnuy advisory revision feed to catch addenda (e.g. IOCs, exploitation telemetry).
  • Add Cisco Secure Workload cluster URLs to your continuous external attack surface management (EASM) inventory and alert on any unauthorised re-exposure.
  • Implement Site Admin action review: SOC dashboards that list every Site Admin-level audit event (scope create/modify, user invite, integration add, agent re-key) with source IP and correlation to authenticated login events.
  • For MSPs operating shared Secure Workload clusters, add cross-tenant action detection — any single API session touching multiple tenant scopes should be alerted.
  • Rotate any credentials, API keys, SAML/OAuth integration secrets, and connector service accounts that have been stored within the cluster if exploitation is suspected.
  • Establish a CWE-306 (missing-authentication) regression review for any internally developed REST APIs to catch the same class of bug in homegrown code.

CVEs associated with Cisco Secure Workload CVE-2026-20223

CVE-2026-20223

Weaknesses (CWE) in Cisco Secure Workload CVE-2026-20223

CWE-306

Timeline of Cisco Secure Workload CVE-2026-20223

  • NVD entry for CVE-2026-20223 published with CVSS 3.1 base score 10.0 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-306.
  • Cisco PSIRT publishes advisory cisco-sa-csw-pnbsa-g8WEnuy (Version 1.0 Final) at 16:00 GMT, including fixed releases 3.10.8.3 and 4.0.3.17.
  • Cisco patches the Secure Workload SaaS deployment server-side prior to public disclosure — no customer action required for SaaS-hosted tenants.
  • Cisco PSIRT assigns CVE-2026-20223 and internal bug ID CSCwt99942; CWE-306 classification applied.
  • Vulnerability identified by Cisco during internal security testing of the Secure Workload Cluster Software (per advisory ''Source'' section).
  • Threadlinqs Intelligence opens TL-2026-0548 to track on-prem patch rollout, monitor for PoC publication, and watch BeaconBeagle and CTI feeds for in-the-wild exploitation attempts.
  • BleepingComputer publishes an article highlighting the maximum-severity rating and the absence of workarounds; broader infosec media follows.
  • As of 2026-05-29, Cisco CVE-2026-20223 (Secure Workload, CVSS 10.0) is fully patched: SaaS fixed server-side and on-prem fixes shipped (3.10.8.3 / 4.0.3.17). Cisco PSIRT (advisory still v1.0 Final) reports no public PoC and no malicious use, and it is not in CISA KEV, so it is no longer a live concern though unpatched on-prem clusters warrant monitoring.

Sources cited for Cisco Secure Workload CVE-2026-20223

Threats related to Cisco Secure Workload CVE-2026-20223

Detection coverage for TL-2026-0548

As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0548 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats