EUVD-2026-62561
GHSA-ww3x-c34w-8v6x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Secure Workload account
-
DeliveryReach network-accessible UI/API
-
ExploitSubmit input with unneutralized special elements
-
ExecutionInjection executes in higher-privileged/cross-tenant context
-
PersistEscalate across changed scope boundary
-
ImpactFull compromise of policy and workload data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires valid authenticated access to Cisco Secure Workload at a low privilege level (CVSS PR:L) - a legitimate but non-administrative tenant, operator, or API account - reachable over the network (AV:N) with low attack complexity and no user interaction. The limiting factor is that no anonymous/unauthenticated path is indicated by the vector: an attacker must first obtain low-privileged credentials or a valid session. The generic vendor description does not name the exact injectable feature, protocol, or configuration setting, so the specific vulnerable input surface is not confirmed from available data; the scope change (S:C) indicates the injected payload crosses into a component outside the attacker's authorized privilege or tenant boundary. Any Secure Workload release prior to the hardening fix is considered exposed. |
| Impact | The CVSS 3.1 base score is 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: network-reachable, low complexity, requiring only low privileges and no user interaction, with a scope change and total CIA impact - a genuinely high-severity profile because an already-authenticated low-privileged user can pivot to full compromise. However, real-world urgency is tempered by several signals: the vulnerability was discovered internally by Cisco (not observed in attacks), there is no public exploit identified at time of analysis, it is not in CISA KEV, and no EPSS score was supplied in the input. The requirement of valid low-privileged credentials (PR:L) meaningfully limits opportunistic mass exploitation compared to a PR:N flaw. The description is a generic hardening-advisory blurb and does not describe the specific injection mechanism, so the exact exploitation path is not confirmed from available data - the 9.9 rating and scope change should be treated as vendor-assessed rather than independently verified. Net: a real patching priority for organizations running Secure Workload due to the critical score and authenticated-but-low bar, but the absence of KEV/POC/EPSS signals suggests no evidence of active or imminent widespread exploitation. |
| Exploit ScenarioDerived | An attacker who holds or phishes a low-privileged Secure Workload tenant/operator account submits crafted input containing special elements into a field or API parameter that the platform fails to neutralize, causing the payload to be interpreted by a downstream component running in a higher-privileged or cross-tenant context. Leveraging the changed scope, the attacker escalates to full read/write control over segmentation policy and workload data beyond their authorized boundary. No public exploit is identified at time of analysis, and successful exploitation depends on possessing valid low-level credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neutralization of special elements (CWE-74 injection class), allowing a low-privileged authenticated user to inject crafted input that breaks the application security boundary. Because the CVSS scope is changed (S:C) with full confidentiality, integrity, and availability impact, an attacker with limited access can affect components beyond their authorized scope. The issue was found internally by Cisco during a hardening review and is addressed in a consolidated software hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade to the fixed software hardening release identified in Cisco Security Advisory cisco-sa-hardening-csw1-shSvndWP (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP); this is Patch available per vendor advisory, but the input does not provide a single exact fixed version number, so consult the advisory's fixed-release table for the specific target build corresponding to your current train. Because exploitation requires an authenticated low-privileged account, compensating controls until you can patch include tightening account provisioning and auditing existing Secure Workload user/role assignments, removing unnecessary low-privilege or tenant accounts, and restricting network access to the Secure Workload management/UI and API endpoints to trusted administrative networks or a jump host (trade-off: may disrupt legitimate integrations and remote operators). Increase monitoring of Secure Workload audit logs for anomalous API/UI input and privilege-boundary crossings. Do not rely on these controls as a substitute for the hardening release given the critical, scope-changing nature of the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Workload is Cisco's data-center and cloud workload micro-segmentation and application-dependency-mapping platform (formerly branded Tetration), used to enforce zero-trust segmentation policy across servers and containers. The root cause is CWE-74, improper neutralization of special elements in output/commands, the parent class covering injection flaws (command, expression, SQL, or similar) where attacker-controlled data is passed into an interpreter or downstream component without proper escaping. The affected CPE is cpe:2.3:a:cisco:cisco_secure_workload, spanning a very wide range of releases from the 1.x/2.x line through 3.x and 4.0.x. The changed scope (S:C) in the CVSS vector indicates the injection crosses a trust/authorization boundary - consistent with a multi-tenant appliance where injected input executes in a context more privileged than, or logically separate from, the attacker's own tenant or role.
Know when Cisco Secure Workload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable authenticated low-privilege user (PR:L) injects unneutralized input crossing a tenant/privilege boundary (S:C) yielding full CIA impact; low complexity, no user interaction.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20231 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) CWE-74.
Executive ViewAI
Cisco Secure Workload contains a critical privilege escalation vulnerability (CVE-2026-20231) requiring authenticated access that allows low-privileged users to inject crafted input and bypass security boundaries to access data across tenant boundaries. Organizations with multi-tenant Secure Workload deployments face immediate risk of unauthorized data access, modification, and service disruption affecting multiple business units or customers.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict low-privileged user permissions and require approval for elevated operations; implement comprehensive audit logging for authentication and cross-tenant access events; apply input validation and filtering for special characters at the application layer; segregate multi-tenant environments at the network layer; enable continuous monitoring for anomalous access patterns across tenant boundaries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Cisco Secure Workload
View allAuthentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromis
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent a
Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpo
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse imprope
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a
Exploit-DB