Cisco Secure Workload CVE-2026-20223 (CVSS 10.0) - unauthenticated REST API admin access flaw
Anyone running Cisco Secure Workload on-premise should patch immediately. Cisco $CSCO disclosed CVE-2026-20223 on May 21, a vulnerability rated the maximum CVSS score of 10. An unauthenticated attacker can hit an internal REST API endpoint and instantly gain Site Admin privileges
Anyone running Cisco Secure Workload on-premise should patch this week. Cisco $CSCO disclosed CVE-2026-20223 on May 21, a flaw rated CVSS 10 out of 10. The bug sits in internal REST API endpoints inside the Cluster Software where authentication and input validation are missing. An attacker sends a crafted HTTP request and instantly receives Site Admin privileges, then can read sensitive workload data, change firewall and segmentation policies, and pivot across tenant boundaries in shared deployments. There are no workarounds. The SaaS version is already patched. On-prem operators must move to fixed releases 3.10.8.3 or 4.0.3.17. Release 3.9 and earlier require migration to a supported branch. Cisco says it has not yet seen exploitation in the wild, but a CVSS 10 unauthenticated bug with public detail is a magnet for scanners.