EUVD-2026-62569
GHSA-vpw3-87c9-76xj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Secure Workload management interface
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication check (CWE-287)
-
ExecutionGain unauthorized platform access
-
ImpactAlter policy or disrupt service across scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation with no user interaction against network-reachable Cisco Secure Workload management/API surfaces - no special product feature toggle is named in the description. The primary limiting factor is network reachability: Secure Workload is typically deployed inside a data center or management enclave, so exploitation requires the attacker to reach its interfaces, and organizations that isolate the management plane substantially reduce exposure. The description does not specify a required non-default configuration; it states only that CWE-287 improper-authentication issues were found in the listed versions, so any of those unpatched releases exposed to an attacker-reachable network should be considered exploitable. |
| Impact | The signals are strong but partially incomplete. CVSS 3.1 is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H - network-reachable, low complexity, no authentication, no user interaction, and a scope change, all of which argue for high real-world risk. Notably the vector sets C:N (no confidentiality impact) while I:H and A:H are high, so the maximum score is driven by integrity/availability compromise plus scope change rather than data theft. However, no EPSS score was provided, there is no KEV listing, and no POC has been identified, so exploitation probability cannot be quantified from the input - the 10.0 reflects potential severity, not observed exploitation. The disclosure originates from Cisco's own internal hardening review rather than in-the-wild discovery, which tends to correlate with no active exploitation yet. Treat as a high-priority patch on exposure grounds, but note that the absence of EPSS/KEV/POC data means urgency is inferred from CVSS alone, not confirmed by exploitation telemetry. |
| Exploit ScenarioDerived | An attacker with network access to a Secure Workload management or API endpoint sends crafted requests that bypass the authentication check, gaining the ability to alter policy or disrupt the platform without valid credentials. Given the scope change (S:C), the attacker can then affect workloads or resources governed by Secure Workload beyond the initially compromised component. No public POC has been identified, so this scenario is derived from the CVSS vector rather than observed exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch.
RemediationAI
Patch available per vendor advisory: upgrade Cisco Secure Workload to a fixed hardening release as specified in Cisco Security Advisory cisco-sa-hardening-csw1-shSvndWP (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP); no exact fixed version string is provided in the available input, so consult that advisory to map your running release to its patched build. Because this is an authentication-bypass reachable over the network, until you can schedule the upgrade the practical compensating controls are to restrict network reachability of the Secure Workload management/API interfaces to trusted administrative networks or a jump host (via firewall ACLs, management VLAN isolation, or VPN-only access), which reduces exposure but does not remove the flaw and may disrupt integrations or agents that legitimately reach those interfaces. Cisco has not published a standalone workaround for this class of internally discovered issue, so upgrading is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Workload is a data-center micro-segmentation and workload-protection platform (previously branded Tetration) that enforces zero-trust policy across servers, VMs, and containers. The affected component is the CPE cpe:2.3:a:cisco:cisco_secure_workload, spanning releases from the 1.x/2.x train through 3.x and 4.0.x. The root cause class is CWE-287 (Improper Authentication), meaning an authentication mechanism can be circumvented or does not correctly validate the identity of a requester; combined with the CVSS scope-change flag (S:C), the compromise of the vulnerable authentication boundary grants impact on resources managed under a different security authority than the one that was breached. Because Secure Workload acts as a policy authority for many downstream workloads, a scope change here is especially significant.
Know when Cisco Secure Workload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Improper authentication reachable over the network with no privileges or interaction, and a scope change into managed workloads; integrity and availability high, confidentiality unaffected per vendor vector.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20317 are related to improper authentication issues that are grouped under the Common Weakness Enumeration (CWE) CWE-287.
Executive ViewAI
Cisco Secure Workload deployments are vulnerable to a critical remote authentication bypass (CVSS 10.0) that allows attackers to compromise system integrity and availability without credentials, affecting all unpatched instances organization-wide. No vendor patch is currently available, creating an urgent containment requirement while awaiting a fix. This vulnerability directly impacts the trustworthiness of security posture data your organization relies on for network defense decisions.
Pending vendor patch: restrict network access to Cisco Secure Workload management interfaces to a whitelist of authorized administrator workstations and jump hosts; implement 24/7 monitoring with alerting on authentication failures, administrative API calls, and configuration changes; consider operational throttling of data ingestion to limit exposure of sensitive network telemetry; maintain detailed incident response playbooks specific to this vulnerability; establish an executive escalation path if exploitation indicators are detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cisco Secure Workload
View allAuthentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent a
Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpo
Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neut
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse imprope
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a
Exploit-DB