Cisco Secure Workload contains a critical security vulnerability identified as CVE-2026-20223 with a CVSS score of 10.0. The vulnerability arises from insufficient validation and authentication in the product's internal REST API endpoints. Exploitation requires sending a crafted API request, which can grant an attacker Site Admin privileges, allowing them to access and modify sensitive data and configurations across tenant boundaries. This affects both SaaS and on-premises deployments, but not the web-based management interface. Cisco has issued patches in versions 3.10.8.3 and 4.0.3.17 to remediate the issue. No exploitation in the wild has been reported.

Successful exploitation grants remote attackers Site Admin privileges within Cisco Secure Workload, enabling them to read sensitive information and modify configurations across tenant boundaries. This could lead to significant unauthorized access and control over affected environments. The vulnerability affects both SaaS and on-premises deployments but does not impact the web management interface. No known active exploitation has been reported.

Cisco has released official patches in Secure Workload versions 3.10.8.3 and 4.0.3.17 that address this vulnerability. Users should promptly update to these versions to mitigate the risk. Since this vulnerability affects internal REST APIs and not the web interface, restricting access to these APIs where possible may reduce exposure. There are no indications of active exploitation, but timely patching is strongly recommended to prevent future attacks.