EUVD-2026-62570
GHSA-gmcf-5grf-3p5g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Secure Workload network interface
-
DeliverySend crafted request to privileged endpoint
-
ExploitBypass authorization check (CWE-284)
-
ExecutionGain unauthenticated privileged access
-
ImpactRead/alter segmentation policy and disrupt platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker requires network reachability to the affected Cisco Secure Workload interface (CVSS AV:N) and no credentials, no privileges, and no user interaction (PR:N/UI:N, AC:L), consistent with the vendor 'Authentication Bypass' tag - meaning against a reachable, unpatched instance no special product configuration is documented as required. The primary limiting factor is exposure: exploitation depends on the attacker being able to reach the management/API surface, so deployments that isolate that interface to a restricted administrative network materially reduce reachable attack surface. Note that Cisco's grouped hardening advisory does not publish the specific vulnerable endpoint or any 'only-when-configured' precondition, so beyond network reachability the exact triggering feature is not confirmed from available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) describes the worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with a scope change and total confidentiality, integrity, and availability impact - consistent with an authentication bypass on a security-enforcement platform. Against this, the exploitation-probability signals are muted: no EPSS score is provided, there is no CISA KEV listing, and no public POC exists, and the CVE originates from an internal Cisco security review rather than observed in-the-wild abuse, so widespread opportunistic exploitation is not currently indicated. The practical caveat is that Cisco's grouped 'hardening release' advisories bundle multiple internally discovered issues and typically omit granular technical detail, so the exact vulnerable endpoint and preconditions are not publicly specified - the maximal CVSS should be treated as vendor-assigned worst case pending advisory detail, but given the product's role in enforcing segmentation policy, a genuine unauthenticated bypass warrants priority patching. |
| Exploit ScenarioDerived | An attacker who can reach the Cisco Secure Workload management or API interface over the network sends crafted requests to a privileged endpoint that fails to enforce authorization, bypassing authentication entirely. Because the scope is changed and impact is total, the attacker could then read sensitive segmentation policy and workload inventory, alter or disable enforcement policy, and disrupt the platform. No public exploit code is currently available, so this remains a plausible-but-unproven scenario derived from the CVSS profile. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade Cisco Secure Workload to the software-hardening release referenced in cisco-sa-hardening-csw1-shSvndWP (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP); the input does not specify an exact fixed version string, so verify the fixed build for your branch (1.x, 2.x, 3.x, or 4.0.x) directly in that advisory before scheduling the upgrade. No vendor workaround is enumerated in the available data, which is typical for access-control bypasses that require corrected authorization logic; as compensating controls pending upgrade, restrict network reachability of the Secure Workload management UI and API interfaces to trusted administrative networks or a jump host (ACLs, management-VLAN isolation, or VPN) and monitor authentication and admin-action logs for anomalous access - with the trade-off that network restriction does not remediate the underlying bypass and, if applied too broadly, may impede legitimate integrations or agent communication.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Workload is Cisco's data-center and cloud workload micro-segmentation and application-dependency-mapping platform (previously branded Tetration), deployed as an on-premises appliance cluster or SaaS offering that enforces zero-trust segmentation policy across workloads. The single affected CPE is cpe:2.3:a:cisco:cisco_secure_workload, spanning a very broad version set from 1.102.x/1.103.x and 2.0.x up through 3.x and 4.0.3.x. The root cause is CWE-284 (Improper Access Control): the software fails to properly enforce authorization on a network-reachable interface, and the vendor tag explicitly characterizes this as an Authentication Bypass, meaning the affected component does not correctly validate that a requester is authenticated/authorized before granting privileged functionality.
Know when Cisco Secure Workload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vendor-tagged unauthenticated authentication bypass over the network with no user interaction gives AV:N/AC:L/PR:N/UI:N; compromise of a security-enforcement platform justifies S:C and full C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20315 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Executive ViewAI
Cisco Secure Workload contains a critical authentication bypass vulnerability (CVSS 10.0) permitting unauthenticated remote attackers to fully compromise the platform, disabling threat detection and creating unobserved lateral movement pathways within the enterprise network. Organizations using Secure Workload for visibility and threat response face immediate operational risk and potential security blind spots. Urgent containment is required as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Secure Workload management interfaces via firewall rules and IP whitelisting; enforce VPN-only administrative access; deploy Web Application Firewall rules to block injection attacks; enable comprehensive audit logging of all console and API access; require multi-factor authentication at network perimeter; implement network segmentation isolating the platform from trusted corporate segments; monitor for behavioral anomalies indicating unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cisco Secure Workload
View allAuthentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromis
Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpo
Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neut
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse imprope
Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a
Exploit-DB