Cisco admits Secure Workload fails to secure workload

If The Onion wrote about network infrastructure, I imagine they would make up stories like this real Cisco critical advisory CVE-2026-20223.

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role.

The thing that turned its CVSS into a perfect 10 instead of a 9.8 was the cross-tenant reach (Scope Changed), which means a breach escapes the security boundary and reaches resources under a different authority. On a microsegmentation product, the scored vector is literally saying its segmentation boundary does not segment.

Is a fence that has no fence still a fence?

Do you take a fence when you find design flaws?

CWE-306 is how Cisco classified it: Missing Authentication for Critical Function. A security replacement for the perimeter that depends on the perimeter for security is Onion-level engineering.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.