EUVD-2026-62561
GHSA-ww3x-c34w-8v6x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable authenticated low-privilege user (PR:L) injects unneutralized input crossing a tenant/privilege boundary (S:C) yielding full CIA impact; low complexity, no user interaction.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20231 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) CWE-74.
AnalysisAI
Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neutralization of special elements (CWE-74 injection class), allowing a low-privileged authenticated user to inject crafted input that breaks the application security boundary. Because the CVSS scope is changed (S:C) with full confidentiality, integrity, and availability impact, an attacker with limited access can affect components beyond their authorized scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid authenticated access to Cisco Secure Workload at a low privilege level (CVSS PR:L) - a legitimate but non-administrative tenant, operator, or API account - reachable over the network (AV:N) with low attack complexity and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: network-reachable, low complexity, requiring only low privileges and no user interaction, with a scope change and total CIA impact - a genuinely high-severity profile because an already-authenticated low-privileged user can pivot to full compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed software hardening release identified in Cisco Security Advisory cisco-sa-hardening-csw1-shSvndWP (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP); this is Patch available per vendor advisory, but the input does not provide a single exact fixed version number, so consult the advisory's fixed-release table for the specific target build corresponding to your current train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Cisco Secure Workload instances, document current software versions, and assess tenant configurations with multi-tenant environments flagged as highest priority; initiate contact with Cisco support to confirm the consolidated software hardening release timeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Secure Workload
View allAuthentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromis
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent a
Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpo
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse imprope
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today