Back Beyondmachines

Cisco Patches Critical CVSS 10.0 Authentication Bypass in Secure Workload

Beyondmachines • May 21, 2026

Advisory Cisco Patches Critical CVSS 10.0 Authentication Bypass in Secure Workload

Take action: Make sure your Cisco Secure Workload clusters are isolated from the internet and accessible only from trusted networks. If you run on-premises Cisco Secure Workload, immediately update to version 3.10.8.3 or 4.0.3.17 to patch CVE-2026-20223; if you're on versions 3.9 or older, plan a migration to a supported patched release since no direct updates are available.

Cisco reports a critical vulnerability in its Secure Workload platform, affecting both cloud-based SaaS and on-premises cluster software. The flaw allows unauthenticated attackers to gain full administrative control over the system

The flaw is tracked as CVE-2026-20223 (CVSS score 10.0) - A missing authentication vulnerability in the internal REST API endpoints of Cisco Secure Workload Cluster Software that allows unauthenticated remote access. Attackers can trigger the flaw by sending specially crafted API requests to affected internal endpoints that lack proper validation checks. Successful exploitation grants the attacker Site Admin privileges, enabling them to read sensitive data or modify system configurations across different tenant environments.

This security issue affects Cisco Secure Workload Cluster Software on all deployment types, including SaaS and on-premises installations:

Cisco has already applied patches to its cloud-based SaaS environments, so those customers do not need to take manual action.

Administrators of on-premises deployments must immediately update to version 3.10.8.3 or 4.0.3.17 to secure their systems.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zero-Day Vulnerability CVE-2026-20182 Exploited in Cisco SD-WAN Systems Cisco has disclosed a critical authentication bypass vulnerability, CVE-2026-20182, affecting its Catalyst SD-WAN Controller and Manager. This flaw allows unauthenticated remote attackers to bypass authentication and gain administrative privileges, enabling manipulation of network configurations. The vulnerability has a CVSS score of 10.0 and is actively exploited in the wild by a threat actor known as UAT-8616, who previously exploited a similar vulnerability, CVE-2026-20127. Cisco became aware of the exploitation in May 2026 and has released patches to address the issue. Organizations are urged to apply these updates immediately, as there are no effective workarounds. The vulnerability impacts all deployment types of the Cisco Catalyst SD-WAN, including cloud and on-premises solutions. Security advisories have been issued to monitor for unauthorized access attempts. 131 sources 87

Extracted Entities

Cisco Patches Critical CVSS 10.0 Authentication Bypass in Secure Workload

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (3)

Platforms (2)