Loading story…
Cisco disclosed CVE-2026-20223, a critical CVSS 10.0 vulnerability in Cisco Secure Workload Cluster Software that allows an unauthenticated remote attacker to gain Site Admin privileges by sending crafted requests to internal REST API endpoints. The flaw stems from insufficient authentication and access validation (CWE-306) and affects both SaaS and on-premises deployments, enabling access to site resources, exposure of sensitive information, and configuration changes that can cross tenant boundaries.
Cisco said its hosted SaaS environments have already been remediated, while customers running affected versions must upgrade because no workaround is available. Fixed releases include 3.10.8.3 and 4.0.3.17, with the issue affecting version 3.9 and earlier, versions before 3.10.8.3, and versions before 4.0.3.17. Cisco and the Canadian Centre for Cyber Security urged administrators to review the advisory and apply updates promptly; Cisco said it is not aware of active exploitation and reported that the vulnerability was identified during internal security testing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-491 highlighting Cisco's May 20 security advisories and specifically calling attention to the critical Cisco Secure Workload issue. It urged administrators to review Cisco's guidance and apply the necessary updates.
Cisco made fixes available for affected on-premises deployments in versions 3.10.8.3 and 4.0.3.17, with no workaround provided. Cisco also stated that its hosted SaaS environments had already been remediated and that it was not aware of active exploitation.
Cisco disclosed CVE-2026-20223, a critical unauthorized API access vulnerability in Cisco Secure Workload caused by insufficient validation and authentication on internal REST API endpoints. The flaw can let an unauthenticated remote attacker gain Site Admin privileges, access sensitive information, and make configuration changes across tenant boundaries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcescworld.com
Open sourcesocradar.io
Open sourcethecyberexpress.com
Open sourcetheregister.com
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco disclosed two vulnerabilities in **Cisco Identity Services Engine (ISE)** and **Cisco ISE Passive Identity Connector (ISE-PIC)**, including the critical remote code execution flaw `CVE-2026-20181` and the high-severity information disclosure flaw `CVE-2026-20190`. Cisco said `CVE-2026-20181` carries a CVSS score of **9.1** and can let an authenticated attacker with valid administrative credentials execute arbitrary commands, obtain user-level access, potentially escalate privileges to root, and in single-node deployments trigger a denial-of-service condition. The second flaw, rated **7.5**, can allow an unauthenticated attacker to access sensitive information such as hashed credentials because of improper authorization checks. The affected software includes all releases prior to **3.3**, versions before **3.3 Patch 11** in release 3.3, versions before **3.4 Patch 6** in release 3.4, and versions before **3.5 Patch 4** in release 3.5, according to the Canadian Centre for Cyber Security notice summarizing Cisco’s advisories. Cisco said the vulnerabilities are independent, no workarounds are available, and no confirmed exploitation had been reported at disclosure time. Authorities urged administrators to review Cisco’s advisories and apply the available updates immediately.
Jun 29, 2026
Cisco disclosed a critical certificate validation vulnerability in cloud-based **Webex Services** that could let an unauthenticated remote attacker bypass authentication and impersonate legitimate users in environments using single sign-on through **Webex Control Hub**. The flaw, tracked as `CVE-2026-20184` and rated **CVSS 9.8**, stems from improper certificate validation in the SSO implementation (`CWE-295`), which could cause malicious authentication tokens to be accepted as valid. Cisco said it patched the backend cloud service, but affected organizations must also manually upload a new **SAML certificate** for their Identity Provider in Webex Control Hub to fully remediate the issue. The company said there are **no workarounds**, warned that customers who do not update their SAML certificates may remain exposed and could face service disruption, and added that the vulnerability was found during internal security testing with **no known public exploitation** reported at disclosure.
Jun 29, 2026