CVE-2026-20223 -- CVSS 10.0 Vulnerability Briefing

CVE-2026-20223 | CVSS 10.0 (Critical) | Exploit: PoC available

What Is It

CVE-2026-20223 is an authentication bypass vulnerability affecting the internal REST API access validation layer of Cisco Secure Workload, allowing unauthenticated remote attackers to interact with protected site resources.

Technical Detail

The flaw stems from insufficient validation and authentication controls applied to internal REST API endpoints within Cisco Secure Workload. An unauthenticated remote attacker can craft and submit API requests to affected endpoints without presenting valid credentials, bypassing access controls entirely. A successful exploit grants the attacker the privileges of the Site Admin role, enabling read access to sensitive data and potentially full administrative control over workload segmentation policies, configurations, and connected infrastructure.

Exploitation Status

A proof-of-concept exploit is publicly available. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, meaning active in-the-wild exploitation has not been formally confirmed by CISA as of this writing. However, the combination of a CVSS score of 10.0, no authentication requirement, and available PoC code significantly elevates the risk of exploitation in the near term.

Who Is Targeting This

No specific threat actor attribution at this time. Given the nature of the affected product, which is used in enterprise data center and cloud workload segmentation environments, opportunistic attackers as well as threat actors targeting enterprise network infrastructure would have strong motivation to weaponize this vulnerability.

What To Do

Apply Cisco's patch for Cisco Secure Workload immediately, treating this as a critical priority given the maximum CVSS score and available PoC. Organizations should review Cisco's security advisory for fixed software versions and upgrade accordingly. As an interim measure, restrict network-level access to Cisco Secure Workload management interfaces and REST API endpoints to trusted administrative hosts only, using firewall rules or access control lists. Monitor API access logs for anomalous or unauthenticated request patterns targeting internal REST endpoints. Given the PoC availability, assume exploitation attempts are imminent and prioritize remediation accordingly.