### Critical Cisco Secure Workload Vulnerability A maximum-severity vulnerability has been discovered in **Cisco** Secure Workload, potentially allowing attackers to access sensitive data without authentication. The vulnerability, tracked as **CVE-2026-20223**, has a CVSS score of 10.0, indicating its critical nature. ### Technical Details The vulnerability stems from insufficient validation and authentication mechanisms when accessing REST API endpoints. According to **Cisco**, an attacker could exploit this by sending a crafted API request to a vulnerable endpoint. Successful exploitation could grant the attacker the ability to read sensitive information and modify configurations across tenant boundaries, with the privileges of the Site Admin user. ### Impact The flaw affects **Cisco** Secure Workload Cluster Software on both SaaS and on-premise deployments, irrespective of device configuration. **Cisco** has stated that there are no available workarounds to mitigate the vulnerability, emphasizing the need for immediate patching. ### Affected Versions and Fixes **Cisco** has addressed the vulnerability in the following versions: * Cisco Secure Workload Release 3.9 and earlier: Migrate to a fixed release. * Cisco Secure Workload Release 3.10: Fixed in 3.10.8.3. * Cisco Secure Workload Release 4.0: Fixed in 4.0.3.17. ### Discovery and Exploitation **Cisco** discovered the vulnerability during internal security testing. The company reports that there is no evidence of the vulnerability being exploited in the wild. ### Recent Cisco Vulnerabilities This disclosure follows a recent announcement regarding another critical authentication bypass flaw in the **Cisco** Catalyst SD-WAN Controller (**CVE-2026-20182**). This vulnerability is actively being exploited by a threat actor known as UAT-8616 to gain unauthorized access to SD-WAN systems.