CVSS 10.0. Ten out of ten. One HTTP request to the internal REST API Cisco Secure Workload without an authorization token – and a remote attacker reads the configuration and changes microsegment policies with Site Admin’s approaches across tenants boundaries. Neither cookie, nor Bearer token, nor any form of authentication between request and administrative access. The product that literally decides who talks to whom in the data center, does not ask "who are you?" at incoming requests.
Below is the analysis of root cause, a positive analysis of the CVSS vector, binding to MITRE ATT&CK and the step-by-step methodology for testing the REST API on similar vulnerabilities of the CWE-306 class.
Business logic: why is it an attacker
Cisco Secure Workload (formerly Cisco Tetration) is a platform for microsegmentation and control of workloads in the data center. Manages access policies between applications, collects telemetry, controls network flows. It is deployed as SaaS or on-prem cluster.
The attacker, exploiting CVE-2026-202223, receives:
• Reading the configuration of all tenants - microsegmental policies, application inventory, network topology of the data center
• Change of security policies - disconnection of segmentation between zones, opening paths for lateral traffic
• Cross-tenant access - in multitenant deployments, one request without authentication gives access to the data of all tenants
If the platform controls segmentation and the attacker controls the platform, the network security of the data center ceases to exist. Cisco confirms that the vulnerability affects SaaS and on-prem deployments regardless of the device configuration. Workaround is missing.
Root cause: CWE-306 and lack of authentication on REST API
From the NVD description: the vulnerability of Cisco Secure Workload arose due to "insufficient validation and authentication when accessing REST APIpoint ends""Insufficient verification and authentication when accessing REST API endpoints".
In practice, this looks like this: the middleware layer responsible for checking authorization tokens on internal REST APIs, was either absent or was incorrectly configured at the routing level. The request came to the processor bypassing the authentication filter, and the processor performed an operation with maximum privileges (Site Admin). The classic of architectural failure is not a bug in the line of code, but a hole in the conveyor processor of requests.
CWE-306 in cloud platforms, one of the most destructive weaknesses. MITRE explicitly specifies this CWE as applicable to Cloud Computing and ICS/OT. The classification: "Access Control: Gain Privileges or Assum Identity" - the attacker accepts the identity of the privileged user without passing authentication.
It's worth demaring here. CWE-287 (parent CWE, broken authentication) - this is when the authentication mechanism exists, but it works crookedly: accepts any token, the signature of JWT incorrectly, something in this spirit. CWE-306 - the authentication mechanism is completely absent. The endpoint is available without headline Authorization,and the server processes the request as legitimate. The difference is between a broken lock and the absence of a door.
CVSS vector analysis: why exactly 10.0
CVSS-vector CVE-2026-20223: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H(Common Vulnerability Scoring System Version 3.1 Calculator)
S:C (Scope: Changed) - this is what brings this vulnerability out of the category "normal auth bypass" category "critical network security vulnerability". REST API is a vulnerable component. But through it, the attacker gets to the resources outside his border: the configurations and data of other tenants, politicians that protect other people's workloads.
The combination of PR:N + UI:N + AV:N makes the vulnerability automated. CISA SSVC confirms: Automatable: yes, Technical Impact: total. At the same time, SSVC solution - Track (monitor), not Act (patch immediately), because Exploitation: none. EPSS-assess from FIRST.org - 0.0083 (percentage 0.5344): the probability of operation is higher than the median value for all CVE, but there is no active operation yet.
For comparison: CVE-2026-20182 Cisco Catalyst SD-WAN Controller (also CVSS 10.0, but CWE-287) has already reached the CISA KEV on May 14, 2026 with EPSS 0.8850 (Top 1%). Public PoC Repository on GitHub (portbuster1337/CVE-2026-20182), nuclei-temper - in the official templates of ProjectDiscovery. For CVE-2026-20223 There's nothing like that yet. The absence of public PoC is a temporary advantage of defenders. The word “temporary” is key here.
Attack chain: from reconnaissance to cross-tenant access
[Applicable: external pentest - SaaS unfolding; internal pentest - on-prem cluster]
The operation of the bypass of API authentication in Cisco Secure Workload is decomposed MITRE ATT&CK:
1. Vulnerability Scanning (T1595.002, Reconnaissance) - scanning the target network, detection of Cisco Secure Workload by characteristic HTTP headers and SSL certificates.
2. Network Service Discovery (T1046, Discovery) )- the definition of available REST API of endpoints. Cisco Secure Workload exhibits the API for cluster management; part of the endpoints is documented, part of the internal.
3. Exploit Public-Facting Application (T1190, Initial Access) is a directed query to a vulnerable endpoint without an Authorization header. Middleware does not block the request - access is received.
4. Cloud API (T1059.009, Execution) - using REST API for administrative operations: configuration reading, changing the policies of microsegmentation.
5. System Information Discovery (T1082, Discovery) and Data from Local System (T1005, Collection) - data extraction: policies, network topology, application inventory for all tenants.
6. Valid Accounts (T1078, Privilege Escalation) )- Data received with Site Admin rights may contain accounts for further movement on infrastructure.
The critical point is the transition from step 2 to step 3. There is no barrier between finding an endpoint and gaining access. Do not need an exploit in the usual sense - a standard HTTP request to the right URL is enough. Even curl That's enough.
REST API testing methodology for bypassing authentication
Adjustments to the environment
• OS: Kali Linux 2024.x+ or any (GNU/Linux)/macOS with installed tools
• Tools: curl(standard), ffufv2.x (github.com/ffuf/ffuf), nucleiv3.x (ProjectDiscovery), Burp Suite Community or Pro
• Network Access: HTTPS Access to Cisco Secure Workload Management Interface (port 443)
• Mode: online, network connection to the target system is required
• Context: external pentest (SaaS - if management interface is available from the Internet) or internal penttest (on-prem cluster)
• Target version: Cisco Secure Workload up to 3.10.8.3 (relétat 3.x) or until 4.0.3.17 (file 4.0)
Detection and verification of API-endpoints
The first step is to make sure that you have the Cisco Secure Workload, and assemble a list of available REST API endpoints. Cisco documents a public API in OpenAPI specifications, but CVE-2026-20223 affects Internal APIs not described in public documentation. So I have to phase.
Fascuring undocumented pathways with the help of ffuf:
Bash:
ffuf -u https://target/api/FUZZ -w /path/to/api-wordlist.txt -mc 200,401,403 -H "Content-Type: application/json" -t 10
Logic of the analysis of answers: 200 without a headline Authorization - potential CWE-306. Codes 401/403 - authentication on the spot (but it is possible to bypass through other vectors: manipulation of headings, substitution of HTTP method, path traversal).
Validation of lack of authentication
After the discovery of endpoints with code 200, the check is reduced to three requests through curl:
Bash:
curl -sk https://target/api/endpoint
curl -sk https://target/api/endpoint -H "Authorization: Bearer invalid"
curl -sk https://target/api/endpoint -H "Authorization: Bearer "
If all three return 200 with data, the endpoint is not protected by authentication. In Burp Suite Pro, it is more convenient to do through Intruder with a payload position on the value of Authorization.
At the time of analysis of the public nuclei template for CVE-2026-20223 It doesn't exist. For CVE-2026-20182 the template is (code/cves/2026/CVE-2026-20182.yaml in the official repository of ProjectDiscovery). Caste Template for Class CWE-306 Goes by analogy.
Restrictions of technology
• Network availability: internal REST API Cisco Secure Workload can be closed for VPN or firewall - external pentest in this case is not applicable
• Product version: only unpalled versions (up to 3.10.8.3 for 3.x branch 3.x, up to 4.0.3.17 for branch 4.0)
• SaaS: Cisco SaaS deployment patchet on your own; testing is possible only until the application of the patch by vendor
• Lack of Public PoC: Specific Vulnerable API Pathways Not Revealed in, Fazzing May Taken Significant Time
Cisco Secure Workload Versions and Patches
Vulnerability CVE-2026-20223 affects Cisco Secure Workload Cluster Software on SaaS and on-prem deployments. The list of affected versions from NVD starts at 1.103.1.12 – essentially the entire product history, including the period when it was called Cisco Tetration. The problem existed from birth.
Below is the analysis of root cause, a positive analysis of the CVSS vector, binding to MITRE ATT&CK and the step-by-step methodology for testing the REST API on similar vulnerabilities of the CWE-306 class.
Business logic: why is it an attacker
Cisco Secure Workload (formerly Cisco Tetration) is a platform for microsegmentation and control of workloads in the data center. Manages access policies between applications, collects telemetry, controls network flows. It is deployed as SaaS or on-prem cluster.
The attacker, exploiting CVE-2026-202223, receives:
• Reading the configuration of all tenants - microsegmental policies, application inventory, network topology of the data center
• Change of security policies - disconnection of segmentation between zones, opening paths for lateral traffic
• Cross-tenant access - in multitenant deployments, one request without authentication gives access to the data of all tenants
If the platform controls segmentation and the attacker controls the platform, the network security of the data center ceases to exist. Cisco confirms that the vulnerability affects SaaS and on-prem deployments regardless of the device configuration. Workaround is missing.
Root cause: CWE-306 and lack of authentication on REST API
From the NVD description: the vulnerability of Cisco Secure Workload arose due to "insufficient validation and authentication when accessing REST APIpoint ends""Insufficient verification and authentication when accessing REST API endpoints".
In practice, this looks like this: the middleware layer responsible for checking authorization tokens on internal REST APIs, was either absent or was incorrectly configured at the routing level. The request came to the processor bypassing the authentication filter, and the processor performed an operation with maximum privileges (Site Admin). The classic of architectural failure is not a bug in the line of code, but a hole in the conveyor processor of requests.
CWE-306 in cloud platforms, one of the most destructive weaknesses. MITRE explicitly specifies this CWE as applicable to Cloud Computing and ICS/OT. The classification: "Access Control: Gain Privileges or Assum Identity" - the attacker accepts the identity of the privileged user without passing authentication.
It's worth demaring here. CWE-287 (parent CWE, broken authentication) - this is when the authentication mechanism exists, but it works crookedly: accepts any token, the signature of JWT incorrectly, something in this spirit. CWE-306 - the authentication mechanism is completely absent. The endpoint is available without headline Authorization,and the server processes the request as legitimate. The difference is between a broken lock and the absence of a door.
CVSS vector analysis: why exactly 10.0
CVSS-vector CVE-2026-20223: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H(Common Vulnerability Scoring System Version 3.1 Calculator)
S:C (Scope: Changed) - this is what brings this vulnerability out of the category "normal auth bypass" category "critical network security vulnerability". REST API is a vulnerable component. But through it, the attacker gets to the resources outside his border: the configurations and data of other tenants, politicians that protect other people's workloads.
The combination of PR:N + UI:N + AV:N makes the vulnerability automated. CISA SSVC confirms: Automatable: yes, Technical Impact: total. At the same time, SSVC solution - Track (monitor), not Act (patch immediately), because Exploitation: none. EPSS-assess from FIRST.org - 0.0083 (percentage 0.5344): the probability of operation is higher than the median value for all CVE, but there is no active operation yet.
For comparison: CVE-2026-20182 Cisco Catalyst SD-WAN Controller (also CVSS 10.0, but CWE-287) has already reached the CISA KEV on May 14, 2026 with EPSS 0.8850 (Top 1%). Public PoC Repository on GitHub (portbuster1337/CVE-2026-20182), nuclei-temper - in the official templates of ProjectDiscovery. For CVE-2026-20223 There's nothing like that yet. The absence of public PoC is a temporary advantage of defenders. The word “temporary” is key here.
Attack chain: from reconnaissance to cross-tenant access
[Applicable: external pentest - SaaS unfolding; internal pentest - on-prem cluster]
The operation of the bypass of API authentication in Cisco Secure Workload is decomposed MITRE ATT&CK:
1. Vulnerability Scanning (T1595.002, Reconnaissance) - scanning the target network, detection of Cisco Secure Workload by characteristic HTTP headers and SSL certificates.
2. Network Service Discovery (T1046, Discovery) )- the definition of available REST API of endpoints. Cisco Secure Workload exhibits the API for cluster management; part of the endpoints is documented, part of the internal.
3. Exploit Public-Facting Application (T1190, Initial Access) is a directed query to a vulnerable endpoint without an Authorization header. Middleware does not block the request - access is received.
4. Cloud API (T1059.009, Execution) - using REST API for administrative operations: configuration reading, changing the policies of microsegmentation.
5. System Information Discovery (T1082, Discovery) and Data from Local System (T1005, Collection) - data extraction: policies, network topology, application inventory for all tenants.
6. Valid Accounts (T1078, Privilege Escalation) )- Data received with Site Admin rights may contain accounts for further movement on infrastructure.
The critical point is the transition from step 2 to step 3. There is no barrier between finding an endpoint and gaining access. Do not need an exploit in the usual sense - a standard HTTP request to the right URL is enough. Even curl That's enough.
REST API testing methodology for bypassing authentication
Adjustments to the environment
• OS: Kali Linux 2024.x+ or any (GNU/Linux)/macOS with installed tools
• Tools: curl(standard), ffufv2.x (github.com/ffuf/ffuf), nucleiv3.x (ProjectDiscovery), Burp Suite Community or Pro
• Network Access: HTTPS Access to Cisco Secure Workload Management Interface (port 443)
• Mode: online, network connection to the target system is required
• Context: external pentest (SaaS - if management interface is available from the Internet) or internal penttest (on-prem cluster)
• Target version: Cisco Secure Workload up to 3.10.8.3 (relétat 3.x) or until 4.0.3.17 (file 4.0)
Detection and verification of API-endpoints
The first step is to make sure that you have the Cisco Secure Workload, and assemble a list of available REST API endpoints. Cisco documents a public API in OpenAPI specifications, but CVE-2026-20223 affects Internal APIs not described in public documentation. So I have to phase.
Fascuring undocumented pathways with the help of ffuf:
Bash:
ffuf -u https://target/api/FUZZ -w /path/to/api-wordlist.txt -mc 200,401,403 -H "Content-Type: application/json" -t 10
Logic of the analysis of answers: 200 without a headline Authorization - potential CWE-306. Codes 401/403 - authentication on the spot (but it is possible to bypass through other vectors: manipulation of headings, substitution of HTTP method, path traversal).
Validation of lack of authentication
After the discovery of endpoints with code 200, the check is reduced to three requests through curl:
Bash:
curl -sk https://target/api/endpoint
curl -sk https://target/api/endpoint -H "Authorization: Bearer invalid"
curl -sk https://target/api/endpoint -H "Authorization: Bearer "
If all three return 200 with data, the endpoint is not protected by authentication. In Burp Suite Pro, it is more convenient to do through Intruder with a payload position on the value of Authorization.
At the time of analysis of the public nuclei template for CVE-2026-20223 It doesn't exist. For CVE-2026-20182 the template is (code/cves/2026/CVE-2026-20182.yaml in the official repository of ProjectDiscovery). Caste Template for Class CWE-306 Goes by analogy.
Restrictions of technology
• Network availability: internal REST API Cisco Secure Workload can be closed for VPN or firewall - external pentest in this case is not applicable
• Product version: only unpalled versions (up to 3.10.8.3 for 3.x branch 3.x, up to 4.0.3.17 for branch 4.0)
• SaaS: Cisco SaaS deployment patchet on your own; testing is possible only until the application of the patch by vendor
• Lack of Public PoC: Specific Vulnerable API Pathways Not Revealed in, Fazzing May Taken Significant Time
Cisco Secure Workload Versions and Patches
Vulnerability CVE-2026-20223 affects Cisco Secure Workload Cluster Software on SaaS and on-prem deployments. The list of affected versions from NVD starts at 1.103.1.12 – essentially the entire product history, including the period when it was called Cisco Tetration. The problem existed from birth.
