Loading vulnerability…
CVE-2026-20223 is a critical authentication bypass vulnerability in Cisco Secure Workload Cluster Software affecting internal REST API access validation. The flaw is caused by insufficient validation and authentication on affected REST API endpoints, allowing requests to be processed without proper authentication checks. A remote attacker can exploit the issue by sending crafted API requests to vulnerable endpoints and obtain effective Site Admin-level access to site resources. The vulnerability affects both SaaS and on-premises deployments, is independent of device configuration, and is limited to internal REST APIs rather than the web-based management interface. Successful exploitation can cross tenant boundaries in multitenant environments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone PoC repository for CVE-2026-20223 targeting Cisco Secure Workload. It contains 5 files total: a README and license, plus two executable PoC implementations—one in Python and one in Bash. The Python script defines a CiscoSecureWorkloadPoC class, sets up a requests session with TLS verification disabled, enumerates a list of privileged REST API endpoints, performs unauthenticated GET requests to identify exposed resources, and then attempts POST requests with JSON user-creation data when an endpoint appears accessible. It also includes a dedicated create_admin_user() routine that posts directly to /api/v1/users to create a Site Admin account. The Bash script mirrors the same logic using curl, logs results, stores temporary responses under /tmp, and tests one extra endpoint (/api/v1/config). Overall, the exploit capability is unauthorized access to privileged web API endpoints and potential unauthenticated creation of a high-privilege administrative user. This is not merely a detector: it includes active exploitation behavior via POST requests and hardcoded account-creation payloads, making it an operational PoC rather than a passive scanner.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Authentication bypass / missing authentication vulnerability in Cisco Secure Workload REST API that allows an unauthenticated remote attacker to access configuration and modify microsegmentation policies with Site Admin privileges across tenant boundaries.
A critical CVSS 10.0 authentication-related vulnerability in the internal APIs of Cisco Secure Workload that could expose a highly privileged zero-trust segmentation platform.
A critical authentication/authorization flaw in Cisco Secure Workload internal REST API endpoints that could allow an unauthenticated remote attacker to read sensitive information and make configuration changes across tenant boundaries with Site Admin-level privileges.
A maximum-severity authentication and validation flaw in Cisco Secure Workload REST API endpoints that could allow an unauthenticated remote attacker to read sensitive information and make configuration changes across tenant boundaries with Site Admin privileges.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.