CVE-2026-20223 is a critical flaw (CVSS 10.0) in the internal REST APIs of Cisco Secure Workload. An unauthenticated remote attacker could access site resources with the privileges of the Site Admin role. Cisco's advisory cisco-sa-csw-pnbsa-g8WEnuy has the fixed releases, so check it and patch urgently.
What's affected
Cisco Secure Workload is named in the record. The record does not list affected or fixed release numbers, so use the Cisco advisory to find them. The CVE text says a successful attack could let the attacker read sensitive information and change configuration across tenant boundaries.
How to check if you're exposed
Sign in to the Secure Workload interface and read the software version from the About or version page. Compare it with the affected and fixed releases in Cisco's advisory.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Identify every Secure Workload cluster and its version.
- Read Cisco's advisory and plan the fixed release as an urgent change.
- Limit network access to the cluster's management and API endpoints.
- After patching, review configuration and policy changes for entries nobody on your team made.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The record says the internal REST API endpoints validate access and authentication insufficiently. With a network vector, no privileges, no interaction and a changed scope, the CVSS score reaches the maximum of 10.0.
Secure Workload sets segmentation policy, so Site Admin rights across tenants mean control over what talks to what. That is why a patch and a review of recent changes both matter. The CVE is not in CISA's KEV list.
What to look for afterward
Because the flaw crossed tenant boundaries, review every tenant, not only the one you consider most exposed. Look at changes to policies, scopes and user roles, and compare them with your change records. If the API endpoints were reachable from outside your management network, treat that as a signal to look harder.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it need credentials?
No. The record says an unauthenticated remote attacker.
Is there a workaround?
The record lists none. Read the Cisco advisory for the current guidance.
Sources
Last reviewed: 19 October 2026.
