# Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via Internal REST API Access-Validation Flaw

> Cisco disclosed CVE-2026-20223, a CVSS 10.0 access-validation flaw in the internal REST APIs of Cisco Secure Workload (formerly Tetration). Unauthenticated remote attackers who can reach an affected endpoint can read sensitive data and change configuration across tenant boundaries with the privileges of the Site Admin role. The SaaS deployment is already fixed; on-prem clusters must upgrade to 3.10.8.3 or 4.0.3.17 — no workarounds exist.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0548
- **ID:** TL-2026-0548
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20223

## Description

On 2026-05-20 Cisco PSIRT published advisory cisco-sa-csw-pnbsa-g8WEnuy disclosing CVE-2026-20223, a maximum-severity (CVSS 3.1 base 10.0, Scope: Changed) vulnerability in the access-validation logic of internal REST API endpoints exposed by Cisco Secure Workload Cluster Software. The flaw is rooted in CWE-306 (Missing Authentication for Critical Function): one or more internal REST API routes fail to enforce authentication and tenancy checks, so a remote attacker who can deliver a crafted HTTP request to the cluster''s API plane can act with the privileges of the Site Admin role without supplying any credential.

Cisco Secure Workload, originally branded Tetration, is the company''s zero-trust microsegmentation and workload-protection platform. A single Secure Workload cluster typically hosts many tenant scopes that map to business units, applications, or customers; Site Admin is the top-of-tree role that owns scope creation, policy enforcement, agent management, RBAC, ingest configuration, and integrations (vCenter, AWS, Azure, Kubernetes, F5/Citrix/AVI ADCs, ServiceNow, IPAM, etc.). Site Admin compromise is therefore equivalent to taking over the customer''s entire microsegmentation control plane.

The vulnerability is reachable network-wide (AV:N, AC:L, PR:N, UI:N) and changes scope (S:C) because the affected component (the internal REST API service) is being abused to perform privileged actions in a different security authority (the per-tenant data plane and policy store). Confidentiality, Integrity and Availability are all rated High. Cisco describes the prerequisite as the ability to ''send a crafted API request to an affected endpoint'' — the advisory does not enumerate the specific endpoint paths, and Cisco has not released a PoC. CWE-306 is the same weakness class behind a long line of Cisco appliance authentication bypasses (CVE-2023-20198, CVE-2024-20418, CVE-2025-20188), and the same triage applies: assume the gap is in a path-routing or middleware layer that processes ''internal'' requests without the normal session/SSO check.

Impact for a real customer is severe. With Site Admin a successful attacker can: read every tenant''s application-dependency map, flow telemetry, and inventory (a complete network blueprint of the protected environment); modify segmentation policies to disable enforcement on any workload (enabling lateral movement deeper into the customer''s environment); push arbitrary configuration to Secure Workload agents on protected hosts (each agent runs as root/SYSTEM); pivot through the platform''s configured connectors (Azure, AWS, vCenter, ServiceNow, AD, LDAP, SAML IdPs) to siphon credentials; create new tenants, users, API keys and external roles to entrench access; and disable audit logging or retention to evade response. Because Scope is Changed, exploitation from one tenant breaks the multi-tenant boundary — managed-service providers operating shared Secure Workload clusters are exposed to cross-customer impact.

Vulnerable Products: Cisco Secure Workload Cluster Software, both SaaS and on-prem deployments, ''regardless of device configuration.'' The web-based management interface itself is not vulnerable — only the internal REST API surface. Fixed Releases: 3.9 and earlier require migration to a fixed release (no in-train fix); 3.10.x is fixed in 3.10.8.3; 4.0.x is fixed in 4.0.3.17. Cisco has already patched the SaaS deployment, so no customer action is required for SaaS-hosted tenants. The Cisco bug tracker ID is CSCwt99942.

Workarounds: None. Cisco''s advisory states explicitly ''There are no workarounds that address this vulnerability,'' so patching is the only mitigation. Compensating controls customers can apply pending an upgrade window: tighten network ACLs on the cluster management VLAN so only the documented administrator subnets and ingest sources can reach the cluster on TCP/443 and the cluster control ports; remove any internet-facing exposure of the Secure Workload UI/API (the product is intended to sit on a management network); enable HTTP request logging at the load balancer / front-end proxy and alert on requests to paths that are not part of the documented OpenAPI specification (/openapi/api/v1, /openapi/oauth, /openapi/scope, /openapi/inventory, /openapi/role, /openapi/agents, /openapi/policies); monitor Secure Workload audit logs for Site Admin actions taken outside of normal change windows or from unfamiliar source IPs.

Exploitation Status: Cisco PSIRT states no public announcements or malicious use have been observed as of advisory publication. No public PoC is available, and the bug was found internally by Cisco. However, the pattern (unauthenticated REST API auth bypass) is operationally trivial to weaponise once an attacker locates the affected endpoint — historically every CVSS 10.0 Cisco appliance bug in this class has been turned into a working exploit within days of disclosure (CVE-2023-20198 IOS-XE Web UI privilege escalation was exploited at scale within 48 hours; CVE-2024-20418 URWB and CVE-2025-20188 ASA/FTD followed similar curves). Defenders should treat the vulnerability as one that will see exploitation attempts almost immediately after a PoC drops, particularly against internet-exposed or partner-accessible Secure Workload clusters.

Detection guidance: The web-based UI is not vulnerable, so defensive instrumentation must sit at the network layer (NetFlow/IPFIX/PCAP on the cluster front-ends) and at the cluster''s reverse proxy access logs. Expect telltale patterns of (a) unauthenticated HTTP requests to API paths that should require an X-Tetration-Cookie / Bearer token, (b) Site Admin-equivalent actions (scope create/modify, agent re-key, user invite, integration add) in audit logs without a preceding authenticated login event, and (c) requests originating from non-administrative source IPs to the cluster on TCP/443 with non-browser User-Agent strings.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1136.003 Create Account: Cloud Account
- T1098.003 Account Manipulation: Additional Cloud Roles
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1068 Exploitation for Privilege Escalation
- T1078.004 Valid Accounts: Cloud Accounts
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1685.002 Disable or Modify Cloud Log
- T1685.006 Clear Linux or Mac System Logs
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1526 Cloud Service Discovery
- T1538 Cloud Service Dashboard
- T1087.004 Account Discovery: Cloud Account
- T1018 Remote System Discovery
- T1080 Taint Shared Content
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1491.001 Defacement: Internal Defacement
- T1531 Account Access Removal

## Sources

- [Cisco Security Advisory cisco-sa-csw-pnbsa-g8WEnuy — Cisco Secure Workload Privilege Escalation Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy)
- [NVD — CVE-2026-20223](https://nvd.nist.gov/vuln/detail/CVE-2026-20223)
- [BleepingComputer — Cisco max-severity Secure Workload flaw gives hackers Site Admin privileges](https://www.bleepingcomputer.com/news/security/cisco-max-severity-secure-workload-flaw-gives-hackers-site-admin-privileges/)
- [MITRE CWE-306 — Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)
- [Cisco Secure Workload Product Page](https://www.cisco.com/site/us/en/products/security/secure-workload/index.html)
- [Cisco Secure Workload OpenAPI Documentation (context for affected API surface)](https://www.cisco.com/c/en/us/td/docs/security/workload_security/secure_workload/user-guide/3_10/cisco-secure-workload-user-guide-on-premise-v310/openapi.html)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [MITRE ATT&CK T1068 — Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0548