ThreatVectr

Cisco Secure Workload Flaw Demands Immediate Attention

Cisco Secure Workload vulnerability allows attackers admin-level access; patch now.

ThreatVectr Newsdesk· 2 min read
Cisco Secure Workload Flaw Demands Immediate Attention
Share

San Jose, Calif. — Cisco identified a critical flaw in its Secure Workload platform. This vulnerability allows remote attackers to gain site admin privileges without authentication, Cisco's advisory said. It affects the on-premises version and scored a maximum 10.0 on the CVSS scale.

By exploiting the vulnerability, identified as CVE-2026-20223, attackers can bypass authentication through a crafted HTTP request to an internal REST API. Consultant Robert Enderle of the Enderle Group said CSOs should prioritize patching, noting the platform's role in zero trust and micro-segmentation.

"If an attacker controls this platform, they own your network," Enderle said. Fred Chagnon, principal research director at Info-Tech Research Group, echoed the urgency. He highlighted the risk of modifying or dismantling security policies, potentially affecting multi-tenant deployments.

Cisco recommends updating systems to version 4.0.3.17 for those on version 4.0, or 3.10.8.3 for version 3.10. Older versions should upgrade to the nearest fixed release. No workarounds exist; only the on-premises product requires action, as Cisco has patched the SaaS version.

Cisco's team discovered and disclosed the vulnerability, publishing a patch simultaneously. No exploitation in the wild has been detected, Chagnon said. Despite this, organizations should treat it as an active threat due to its severity.

In April, Cisco addressed another critical vulnerability in Webex Control Hub. A similar patch was issued in January for Unified Communications Manager and related products. A China-linked group exploited a Secure Email appliance flaw last December, Cisco warned. The next step for administrators is immediate patch implementation.

Latest stories

A close-up, macro, photoreal, news-editorial shot of a tangled cluster of worn ethernet and USB cables plugged into a dusty server strip, bathed in the cool blu
Vulnerabilities

WP2Shell: Two WordPress Flaws Let Attackers Take Over Websites Without Logging In

Criminals are actively exploiting a pair of newly discovered security holes in WordPress to seize full control of websites. Tens of millions of sites were at risk, and patching may already be too late for some.

Jul 20
Full-frame edge-to-edge photoreal editorial shot of a server rack with a single network appliance highlighted by red status LEDs, blurred data center aisle in b
Vulnerabilities

SonicWall Security Devices Were Hacked for Weeks Before a Fix Existed

Criminals planted hidden malware inside SonicWall remote-access appliances at least three weeks before the manufacturer knew the attack routes existed. Two fresh vulnerabilities, now patched, gave intruders near-total control of the devices.

Jul 20
Full-frame edge-to-edge overhead photograph of a large server room aisle at night, cool blue LED indicator lights along both rows of racks, one rack door left s
Vulnerabilities

The Real Mythos Problem Isn't New Bugs. It's How Long Yours Stay Open.

Anthropic's AI-driven vulnerability finder has flooded the pipeline since April. But the harder question for defenders is how many days a known flaw sits unpatched on their own network.

Jul 20
A digital lock symbol over a network diagram, representing cybersecurity
Vulnerabilities

A Flaw in WordPress's Core Code Lets Criminals Take Over Websites Without Logging In

A newly discovered vulnerability in WordPress versions 6.9 and 7.0 lets attackers run their own commands on any affected site with no password required. Patches are out now.

Jul 20
© 2026 Threat Vectr