CISCO Security Advisory
Published Date: May 20, 2026
CVE: CVE-2026-20223
Advisory Summary
Cisco has disclosed a critical security vulnerability (CVE-2026-20223) affecting its Secure Workload platform. The flaw resides in the access validation mechanism of internal REST APIs, permitting unauthenticated remote attackers to gain Site Admin-level privileges. Exploitation occurs through crafted API requests, enabling attackers to read sensitive data and alter configurations across tenant boundaries.
This vulnerability stems from inadequate authentication when accessing REST API endpoints. Given the elevated privileges that can be obtained, the security impact is severe, potentially compromising multi-tenant environments hosted on Cisco Secure Workload.
Cisco has issued software updates that fully address this flaw; no workarounds exist. Immediate patching is strongly advised for all users to mitigate risks of unauthorized access and configuration manipulation.
▶️ IT professionals and infrastructure security teams should prioritize deployment of the updated Cisco Secure Workload releases to safeguard critical workloads and maintain operational integrity.
-20223
Reference: Vendor Advisory