CVE-2026-20223 — Cisco Secure Workload (formerly Tetration)¶

Q: How do I detect CVE-2026-20223?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

Q: How do I block or mitigate CVE-2026-20223?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Key facts

CVE-2026-20223 (Cisco) is a Critical (10.0) vulnerability: Cisco Secure Workload (formerly Tetration). This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-20223
Severity	Critical (10.0)
Vendor	Cisco
Product	Cisco Secure Workload (formerly Tetration)
Detection / prevention	Snort
PoC	poc.py
Source	2026/CVE-2026-20223/

Details¶

CVE-2026-20223 (Cisco) is a Critical (10.0) vulnerability: Cisco Secure Workload (formerly Tetration). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview¶

Field	Value
CVE	CVE-2026-20223
CVSS	10.0 (Critical)
Vendor	Cisco
Product	Cisco Secure Workload (formerly Tetration)
Affected	3.8.x < 3.8.1.2, 3.9.x < 3.9.0.3
Fixed	Upgrade to 3.8.1.2+ or 3.9.0.3+; no workaround available

Root Cause¶

Cisco Secure Workload's internal REST API endpoints contain insufficient validation and authentication controls. Certain API routes that should require Site Administrator credentials fail to enforce authentication checks, allowing unauthenticated HTTP requests to reach privileged API handlers. The root cause is a missing or improperly applied authentication middleware on a subset of internal REST API endpoints — requests to these endpoints bypass the normal token validation pipeline and are processed as if they originate from a fully authenticated Site Admin session. This is a server-side authentication logic flaw (CWE-306: Missing Authentication for Critical Function).

Problem¶

An unauthenticated remote attacker with network access to the Cisco Secure Workload management interface can exploit this vulnerability to gain Site Administrator privileges:

Full administrative takeover: Obtain Site Admin-level access to the Cisco Secure Workload cluster without any credentials, gaining complete control over the workload security platform.
Multi-tenant data access: Read sensitive workload telemetry, network flow data, policy configurations, and inventory data across all tenants managed by the compromised cluster.
Configuration manipulation: Modify security policies, enforcement rules, segmentation labels, and alert configurations across all tenant workspaces — potentially disabling critical security controls.
Credential harvesting: Access API keys, integration tokens (AWS, Azure, vCenter), and LDAP/AD configuration including bind credentials stored within the platform.
Lateral movement: Use compromised integrations (cloud connectors, orchestrator APIs) to pivot into connected infrastructure.
Persistence: Create rogue Site Admin accounts or API keys to maintain access after the initial exploit.

No authentication, credentials, or prior access are required. The only prerequisite is network connectivity to the management interface.

Detection¶

Run the proof-of-concept to test whether your Cisco Secure Workload cluster is vulnerable:

python poc.py --target https://<csw-cluster-fqdn> --check-auth-bypass

The PoC sends unauthenticated HTTP requests to known internal API endpoints that require Site Admin privileges. A vulnerable cluster returns 200 OK with administrative data payloads instead of 401 Unauthorized or 403 Forbidden.

Indicators of compromise: - Cisco Secure Workload audit logs: API calls from unexpected source IPs, especially to /api/v1/users, /api/v1/roles, /api/v1/sensors without corresponding session tokens - Authentication logs: Site Admin actions not correlated with any known admin login session - Network logs: Unexpected outbound connections from the Secure Workload cluster to external IPs - New user accounts or API keys created without corresponding change tickets

Version check:

# Via Cisco Secure Workload UI: Platform → System → About
# Or via API (if accessible):
curl -k https://<cluster>/openapi/v1/application_version

Remediation¶

Upgrade immediately — no workaround exists: Cisco has confirmed there is no configuration-based workaround for this vulnerability. Upgrade is mandatory:
For 3.8.x deployments: upgrade to 3.8.1.2 or later
For 3.9.x deployments: upgrade to 3.9.0.3 or later
Follow the Cisco Secure Workload upgrade guide for your cluster topology (single-node vs. multi-node RPN cluster)
Restrict management interface access: As a defense-in-depth measure (not a fix), restrict network access to the Cisco Secure Workload management UI and API to trusted administrator subnets using upstream firewall ACLs or the platform's built-in network access control list.
Audit for signs of exploitation: Before upgrading, review audit logs for unauthorized API access. Look for actions performed by the system or admin accounts at unusual times or from unexpected IP addresses.
Rotate all credentials post-upgrade: After applying the patch, rotate all API keys, integration credentials (cloud connectors, LDAP bind accounts, orchestrator tokens), and Site Admin passwords stored in or accessible from the platform.
Review tenant configurations: Audit all tenant security policies and user accounts for unauthorized modifications that may have been made during any exploitation window.
Contact Cisco TAC: If exploitation is suspected, engage Cisco Technical Assistance Center for incident response support and forensic guidance specific to Secure Workload.

References¶

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20223
Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-auth-bypass-CVE-2026-20223
Cisco Secure Workload Upgrade Guide: https://www.cisco.com/c/en/us/support/security/tetration/products-installation-guides-list.html

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-20223, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-20223 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signature

# CVE-2026-20223 - Cisco Secure Workload REST API Auth Bypass Detection
# CVSS 10.0 | Unauthenticated Site Admin privilege escalation
# Affected: 3.8.x < 3.8.1.2, 3.9.x < 3.9.0.3

alert tcp any any -> $HTTP_SERVERS 443 (msg:"CVE-2026-20223 Cisco Secure Workload Unauthenticated REST API Access Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/openapi/v1/"; http_uri; content:!"X-Tetration-Oper-Token"; http_header; content:!"Authorization"; http_header; pcre:"/\/openapi\/v1\/(users|roles|tenant|sensors|vrfs)/"; classtype:attempted-admin; sid:9100001; rev:1;)

alert tcp any any -> $HTTP_SERVERS 443 (msg:"CVE-2026-20223 Cisco Secure Workload Site-Admin Endpoint Probe Without Credentials"; flow:established,to_server; content:"/openapi/v1/"; http_uri; pcre:"/\/openapi\/v1\/(roles\?type=SITE_ADMIN|users\?filter=site_admin|tenant\/configuration)/"; content:!"Authorization"; http_header; content:!"X-Tetration-Oper-Token"; http_header; threshold:type limit,track by_src,count 3,seconds 60; classtype:attempted-admin; sid:9100002; rev:1;)

alert tcp any any -> $HTTP_SERVERS 443 (msg:"CVE-2026-20223 Cisco Secure Workload Auth Bypass Successful Response to Unauthenticated Request"; flow:established,to_client; content:"200 OK"; http_stat_msg; content:"\"role\""; http_server_body; content:"\"site_admin\""; http_server_body; pcre:"/\"scope\"\s*:\s*\"SITE_ADMIN\"/"; classtype:successful-admin; sid:9100003; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions¶

What is CVE-2026-20223?¶