Cisco Patches Critical CVSS 10.0 Vulnerability in Secure Workload’s REST API

Cisco has addressed a critical security flaw in its Secure Workload product, assigning it a maximum CVSS score of 10.0. The vulnerability allows unauthenticated, remote attackers to exploit insufficient validation and authentication in REST API endpoints to access sensitive data.

What happened

Cisco released security updates to fix a critical vulnerability, tracked as CVE-2026-20223, affecting its Secure Workload product. The flaw stems from insufficient validation and authentication when handling REST API requests, which could enable an unauthenticated remote attacker to gain unauthorized access to sensitive information. Cisco’s advisory indicates that exploitation requires the attacker to send specially crafted requests to the vulnerable API endpoints.

Why it matters

The severity of this vulnerability is highlighted by its CVSS score of 10.0, the highest possible rating, reflecting its potential impact. Such vulnerabilities in enterprise security software like Cisco Secure Workload can put sensitive organizational data at risk if exploited. Since the flaw is remotely exploitable without authentication, it presents a significant risk surface that attackers could leverage to compromise systems or exfiltrate confidential data.

What security teams should do

Organizations using Cisco Secure Workload should promptly apply the available security patches to remediate this vulnerability. It is also advisable to review network exposure of the affected REST API endpoints and monitor for any unusual access patterns or attempted exploitation activities. Coordinating with Cisco’s guidance and update schedules remains critical to ensuring systems remain secure against this and similar vulnerabilities.

Key technical details

The vulnerability resides in the REST API component of Cisco Secure Workload due to insufficient validation and authentication mechanisms when processing API requests. This weakness allows unauthenticated remote attackers to send crafted requests to API endpoints and gain unauthorized access to sensitive data without requiring legitimate credentials. Cisco assigned this flaw CVE-2026-20223, assessing it with a CVSS base score of 10.0, indicating critical risk and ease of exploitation in its current state.

Affected organizations/products

The vulnerability impacts Cisco Secure Workload, a security product providing visibility and control over workloads. No other Cisco products were identified as affected in the advisory.

Source attribution

https://thehackernews.com/2026/05/cisco-patches-cvss-100-secure-workload.html