EUVD-2026-62572
GHSA-gx2h-r97c-m9pv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-exposed Secure Workload endpoint
-
DeliveryCraft malformed or oversized network payload
-
ExploitSend payload to trigger buffer boundary violation
-
ExecutionProcess memory corrupted or process crashes
-
ImpactWorkload security enforcement or visibility unavailable
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication is required and no special configuration or user interaction is needed - an attacker needs only network-level access to a Cisco Secure Workload service endpoint. The principal limiting factor is network reachability: Cisco Secure Workload cluster management interfaces and agent communication channels are typically deployed within protected data center or private cloud networks, not exposed to the public internet; organizations that follow recommended deployment architecture with management plane isolation significantly reduce their real-world exposure despite the PR:N designation. The description does not specify which component or protocol triggers the vulnerability, so it is unknown whether exploitation requires reaching the web UI, the agent communication port, an internal microservice, or an API endpoint - this ambiguity means defenders should restrict all Secure Workload network surfaces pending vendor clarification. |
| Impact | The CVSS 3.1 base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H presents a straightforward high-severity DoS scenario: network-reachable, low complexity, no authentication, no user interaction, but impact is limited to availability. This is the most impactful signal available - however, the limiting factor is that CWE-119 (buffer bounds violations) can theoretically permit code execution, yet Cisco's advisory constrains the impact to availability only; this may reflect that exploitation leads to process crash rather than controlled code redirection. No EPSS score was provided in the input data, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, meaning real-world exploitation has not been confirmed externally. The internal discovery context is a positive signal - Cisco found and patched this before external researchers or threat actors publicly reported it. The sheer breadth of affected versions (over 100 distinct builds from 1.102.21 to 4.0.3.17) raises operational remediation complexity but does not change inherent exploitability. Priority should be elevated for any deployment where Secure Workload management interfaces or agents are exposed to untrusted networks. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to a Cisco Secure Workload service endpoint sends a specially crafted oversized or malformed request that exceeds buffer boundaries in the platform's processing logic, causing the affected process to crash and rendering the workload security service unavailable. No public proof-of-concept code is known at time of analysis, meaning an attacker would need to independently discover and develop an exploit targeting the specific buffer management flaw. The low attack complexity per CVSS suggests that once a viable payload is identified, exploitation does not require precise timing or environment-specific conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a denial-of-service condition against the platform, with no confidentiality or integrity impact per Cisco's own CVSS assessment. An extremely broad range of versions from 1.x through 4.0.x are affected, spanning many years of releases, indicating this class of flaw was introduced early in the product lifecycle. No public exploit identified at time of analysis and no active exploitation confirmed; Cisco discovered these vulnerabilities internally during a proactive hardening review and issued a software hardening release.
RemediationAI
The primary fix is to upgrade to a Cisco Secure Workload release that includes the hardening changes described in Cisco Security Advisory cisco-sa-hardening-csw1-shSvndWP, available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP. The exact fixed versions are not independently confirmed from the input data; consult the advisory directly for the minimum fixed release within each supported train (3.10.x, 4.0.x). As a compensating control pending upgrade, restrict network access to Cisco Secure Workload management interfaces, agent communication endpoints, and API surfaces using perimeter firewall rules or ACLs to limit exposure to trusted administrative networks - this reduces the AV:N attack vector to a controlled network boundary. Note that this trade-off may reduce telemetry collection fidelity if agent-to-cluster communication is blocked. Given that the impact is availability-only, prioritizing network segmentation of the management plane provides meaningful risk reduction without disabling core enforcement functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Workload (formerly Cisco Tetration) is an enterprise workload security platform providing micro-segmentation, process-level visibility, and compliance enforcement across data center and cloud environments. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) covers a family of memory safety flaws including buffer overflows, out-of-bounds reads, and out-of-bounds writes. In a networked security platform context, these issues typically arise in packet parsing, agent communication protocols, or API request handling routines where externally supplied data length or content is not rigorously validated before use in memory operations. The CPE cpe:2.3:a:cisco:cisco_secure_workload:*:*:*:*:*:*:*:* confirms the wildcard span across all versions, consistent with the lengthy list of affected builds enumerated in EUVD-2026-62572.
Know when Cisco Secure Workload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible service with no authentication per Cisco's own advisory; impact confirmed as availability-only by vendor, with no confidentiality or integrity compromise described.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20319 are related to buffer management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-119.
Executive ViewAI
Cisco Secure Workload versions 1.x through 4.0.x contain unauthenticated denial-of-service vulnerabilities with no current patches available, creating operational risk for organizations' cloud security monitoring and compliance capabilities. The broad affected version range indicates most users are likely impacted and vulnerable to platform outages. Immediate interim protective controls are required pending patch availability.
No vendor-released patch identified at time of analysis. Implement network-based access controls restricting the management interface to trusted administrative sources; deploy rate-limiting and DDoS protection at network perimeter; apply any hardening recommendations from Cisco's security advisory; establish escalation procedures with Cisco support to track patch availability and coordinate rapid deployment when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Cisco Secure Workload
View allAuthentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromis
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent a
Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpo
Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neut
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse imprope
Exploit-DB