tldrdailynews.com logo

Cisco patches critical unauthenticated REST API flaw in Secure Workload

1 min read
Source: The Hacker News
Cisco patches critical unauthenticated REST API flaw in Secure Workload
Photo: The Hacker News
TL;DR

Cisco fixed a high-severity, unauthenticated REST API vulnerability in Secure Workload (CVE-2026-20223, CVSS 10.0) that could let remote attackers read sensitive data and alter tenant configurations across boundaries with Site Admin privileges. The flaw affects Secure Workload Cluster Software on SaaS and on-prem deployments with no available workarounds; patches are available in Release 3.10.8.3 (3.10) and 4.0.3.17 (4.0), with users of 3.9 and earlier advised to migrate. Cisco notes no known exploits in the wild at this time; the article also references a separate CVE-2026-20182 exploit in Catalyst SD-WAN Controller.

Topics:technologysecurity#cisco#cve-2026-20223#data-exposure#rest-api#secure-workload#security
Share this article
  1. Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access  The Hacker News
  2. Cisco Patches Critical Vulnerability in Secure Workload  SecurityWeek
  3. Cisco serves up yet another perfect 10 bug with Secure Workload admin flaw  The Register
  4. Cisco patches security hole with top rating in Secure Workload  heise online
  5. Max severity Cisco Secure Workload flaw gives Site Admin privileges  BleepingComputer

Want the full story? Read the original reporting

Read on The Hacker News