Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via Internal REST API Access-Validation Flaw — Threadlinqs Intelligence
As of 2026-05-30, Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via Internal REST API Access-Validation Flaw is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0548 · Severity: CRITICAL · CVSS: 10 · Status: PATCHED · Category: VULNERABILITY
Cisco disclosed CVE-2026-20223, a CVSS 10.0 access-validation flaw in the internal REST APIs of Cisco Secure Workload (formerly Tetration). Unauthenticated remote attackers who can reach an affected
On 2026-05-20 Cisco PSIRT published advisory cisco-sa-csw-pnbsa-g8WEnuy disclosing CVE-2026-20223, a maximum-severity (CVSS 3.1 base 10.0, Scope: Changed) vulnerability in the access-validation logic of internal REST API endpoints exposed by Cisco Secure Workload Cluster Software. The flaw is rooted in CWE-306 (Missing Authentication for Critical Function): one or more internal REST API routes fail to enforce authentication and tenancy checks, so a remote attacker who can deliver a crafted HTTP request to the cluster''s API plane can act with the privileges of the Site Admin role without supplying any credential.
Cisco Secure Workload, originally branded Tetration, is the company''s zero-trust microsegmentation and workload-protection platform. A single Secure Workload cluster typically hosts many tenant scopes that map to business units, applications, or customers; Site Admin is the top-of-tree role that owns scope creation, policy enforcement, agent management, RBAC, ingest configuration, and integrations (vCenter, AWS, Azure, Kubernetes, F5/Citrix/AVI ADCs, ServiceNow, IPAM, etc.). Site Admin compromise is therefore equivalent to taking over the customer''s entire microsegmentation control plane.
The vulnerability is reachable network-wide (AV:N, AC:L, PR:N, UI:N) and changes scope (S:C) because the affected component (the internal REST API service) is being abused to perform privileged actions in a different security authority (the per-tenant data plane and policy store). Confidentiality, Integrity and Availability are all rated High. Cisco describes the prerequisite as the ability to ''send a crafted API request to an affected endpoint'' — the advisory does not enumerate the specific endpoint paths, and Cisco has not released a PoC. CWE-306 is the same weakness class behind a long line of Cisco appliance authentication bypasses (CVE-2023-20198, CVE-2024-20418, CVE-2025-20188), and the same triage applies: assume the gap is in a path-routing or middleware layer that processes ''internal'' requests without the normal session/SSO check.
Impact for a real customer is severe. With Site Admin a successful attacker can: read every tenant''s application-dependency map, flow telemetry, and inventory (a complete network blueprint of the protected environment); modify segmentation policies to disable enforcement on any workload (enabling lateral movement deeper into the customer''s environment); push arbitrary configuration to Secure Workload agents on protected hosts (each agent runs as root/SYSTEM); pivot through the platform''s configured connectors (Azure, AWS, vCenter, ServiceNow, AD, LDAP, SAML IdPs) to siphon credentials; create new tenants, users, API keys and external roles to entrench access; and disable audit logging or retention to evade response. Because Scope is Changed, exploitation from one tenant breaks the multi-tenant boundary — managed-service providers operating shared Secure Workload clusters are exposed to cross-customer impact.
Vulnerable Products: Cisco Secure Workload Cluster Software, both SaaS and on-prem deployments, ''regardless of device configuration.'' The web-based management interface itself is not vulnerable — only the internal REST API surface. Fixed Releases: 3.9 and earlier require migration to a fixed release (no in-train fix); 3.10.x is fixed in 3.10.8.3; 4.0.x is fixed in 4.0.3.17. Cisco has already patched the SaaS deployment, so no customer action is required for SaaS-hosted tenants. The Cisco bug tracker ID is CSCwt99942.
Workarounds: None. Cisco''s advisory states explicitly ''There are no workarounds that address this vulnerability,'' so patching is the only mitigation. Compensating controls customers can apply pending an upgrade window: tighten network ACLs on the cluster management VLAN so only the documented administrator subnets and ingest sources can reach the cluster on TCP/443 and the cluster control ports; remove any internet-facing exposure of the Secure Workload UI/API (t
Target sectors: financial, government, healthcare, technology, telecommunications, managed-service-providers, critical-infrastructure, energy, manufacturing, retail
Target regions: Global, North America, Europe, Asia-Pacific, Latin America, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-20223, T1595, T1595.002, T1592.002, T1588.005, T1588.006, T1190, T1133, T1059, T1136.003, T1098.003