CVE-2026-20315

CVE-2026-20315 covers improper access control weaknesses (CWE-284) in Cisco Secure Workload that were found by Cisco's own engineering team during an internal security review and fixed in a dedicated software hardening release. Per the CVSS 10.0 vector, the flaws are exploitable remotely by unauthenticated attackers with no user interaction or special conditions required. Because the scope is changed with high confidentiality, integrity, and availability impact, a successful attacker could bypass access restrictions and gain broad, potentially full control over affected Secure Workload components and their data. Any organization running Cisco Secure Workload is affected; the fix ships as part of Cisco's August 19, 2026 advisory batch, which also patched Crosswork flaws, five of which scored the maximum CVSS 10.0. There is no known exploitation, no public proof-of-concept, and no KEV listing, and EPSS estimates only a 0.4% chance of exploitation within the next 30 days.

What to do: Apply the Cisco Secure Workload software hardening release referenced in the August 19, 2026 advisory, checking the Cisco PSIRT advisory for the fixed version matching your deployment type (SaaS or on-premises), since specific fixed-version numbers are not provided in this data. Until patched, restrict network reachability of Secure Workload management interfaces and monitor Cisco advisories for updates. Given the maximum 10.0 severity and unauthenticated network vector, treat patching as urgent even though no exploitation is currently known.