CVE-2026-20231

CVE-2026-20231 bundles multiple injection-class vulnerabilities (CWE-74, improper neutralization of special elements) in Cisco Secure Workload, found by Cisco's own engineers during an internal security review and addressed in a software hardening release published alongside Cisco's August 19, 2026 advisories. The flaws are triggered remotely over the network by an authenticated, low-privileged user who submits input containing special elements that an affected component fails to neutralize. The CVSS 9.9 (critical) score, with a changed scope and high ratings for confidentiality, integrity, and availability, indicates a successful attack could compromise the vulnerable component and potentially extend to other components within the deployment. Only organizations running Cisco Secure Workload (formerly Tetration) are affected, and because valid low-privilege credentials and network access to the product's interfaces are required, exposure is concentrated in enterprise data-center environments. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists; EPSS currently estimates only a 0.5% chance of exploitation within 30 days.

What to do: Consult Cisco's August 19, 2026 Secure Workload advisory for the exact affected and fixed release list, then upgrade the Secure Workload deployment (console and agents) to the hardening release it specifies. Until patched, restrict network access to Secure Workload management interfaces and review which low-privilege accounts can reach them. Because this CVE groups several related injection issues, apply the complete hardening release rather than individual fixes.