Cisco disclosed a 10.0 CVSS vulnerability in its Secure Workload platform that allows unauthenticated attackers to gain Site Admin privileges and access sensitive data across tenant boundaries. The flaw, tracked as CVE-2026-20223, stems from weak validation in internal REST API endpoints.
Attackers require no credentials or user interaction. A successful exploit grants remote access to sensitive information and permits configuration changes across multiple customer tenants—a critical failure in the isolation guarantees that cloud customers depend on.
The vulnerability affects Secure Workload Cluster Software in both SaaS and on-premise deployments. Cisco has already patched its cloud-hosted SaaS instances and reports no active exploitation.
Fixed versions: Secure Workload 3.10.8.3 (for version 3.10) and 4.0.3.17 (for version 4.0). Customers on version 3.9 or earlier must migrate to a supported fixed release. Cisco identified no workarounds.
This disclosure comes less than a week after Cisco patched another maximum-severity flaw in SD-WAN systems that allowed privilege escalation. Over the past year, Cisco has disclosed multiple infrastructure vulnerabilities with CVSS scores of 9.8 or higher, spanning firewalls, management platforms, identity systems and enterprise networking products. The pattern underscores a structural challenge in the company's product security practices—one that carries real business risk for customers evaluating Cisco's infrastructure as the security anchor in their networks.
