As part of Cisco's ongoing commitment to proactive security and product quality

CVE-2026-20317 is an improper-authentication flaw (CWE-287) in Cisco Secure Workload's internal REST API endpoints. An unauthenticated, remote attacker can send crafted API requests that bypass authentication and gain elevated privileges, enabling integrity destruction (config tampering across tenants) and availability impact (service disruption) with scope change beyond the vulnerable component. The affected version range is 1.103.1.12 through 3.5.1.30 — legacy releases that have been out of Cisco's n/n-1 support window for years. Current supported releases (3.10.x, 4.0.x) are not affected. No confidentiality impact exists (CVSS C:N).

Cisco rated this CVSS 10.0 CRITICAL, and the vector math checks out in isolation — unauthenticated, network-reachable, no user interaction, scope change. But the vendor score ignores the real-world population still running these ancient versions. After the May 2026 CVE-2026-20223 forced mass upgrades to 3.10.8.3 or 4.0.3.17, the fraction of deployments still on pre-3.6 code is negligible. SaaS customers were auto-patched months ago. This is a hardening cleanup for versions Cisco barely supports, not a live-fire emergency. The vendor severity dramatically overstates the real-world risk.

Why this verdict

• Legacy-only version range: Only versions 1.103.1.12–3.5.1.30 are affected. These have been unsupported under Cisco's n/n-1 policy for multiple release cycles. The current supported trains are 3.10.x and 4.0.x, which are not vulnerable.
• Post-CVE-2026-20223 upgrade wave: The May 2026 CVSS 10.0 vulnerability (CVE-2026-20223) forced enterprises to upgrade to 3.10.8.3 or 4.0.3.17. Any organization that patched that critical flaw is already on a version unaffected by CVE-2026-20317.
• No exploitation evidence or tooling: Zero in-the-wild exploitation, no public PoC, no researcher disclosure — purely an internal hardening find. Attacker tooling development against undocumented internal APIs for a legacy product version is extremely unlikely.
• Management-network isolation: Secure Workload clusters run on dedicated management appliances or Cisco SaaS (auto-patched). Internal REST APIs are not internet-exposed in any standard deployment architecture.
• Role multiplier: Cisco Secure Workload is a microsegmentation and workload protection platform — canonically a high-value security management plane. (a) On current versions (3.10.x, 4.0.x): chain does NOT succeed, not affected. (b) On affected legacy versions (pre-3.6): chain succeeds, blast radius is fleet-scale policy tampering across managed workloads. (c) However, the installed base on affected versions is estimated at well under 1% post-CVE-2026-20223 upgrade cycle and EOL deprecation, which breaks the CRITICAL/HIGH floor per the role-multiplier rule. If you ARE running a pre-3.6 cluster, treat this as CRITICAL for your environment specifically.

Why not higher?

To warrant HIGH or CRITICAL, the affected population would need to be >=1% of the installed base on a canonically high-value component. The affected versions (pre-3.6) have been out of support for years and the May 2026 CVE-2026-20223 forced the remaining stragglers to upgrade. There is also zero exploitation evidence, zero public PoC, and the internal REST APIs are not internet-reachable in standard deployments.

Why not lower?

Despite the tiny affected population, the theoretical impact on any remaining legacy cluster is severe — unauthenticated access to the security management plane with scope change enables fleet-wide policy manipulation. The attack complexity is low and requires no user interaction. Any organization confirmed to be running an affected version faces genuine CRITICAL-tier risk, which prevents a LOW or IGNORE rating at the population level.

1. Confirm your Secure Workload cluster version immediately — Query your CMDB or Cisco TAC to confirm you are running 3.10.8.3, 4.0.3.17, or later. If confirmed, no further action is needed for this CVE. This is the single highest-ROI action — most enterprises will discover they are not affected.
2. If on a legacy version: restrict network access to internal REST API ports — If you discover you are running a pre-3.6 version, immediately apply ACLs or firewall rules to restrict access to the Secure Workload cluster's internal REST API ports to only authorized management hosts. This is a temporary measure — no mitigation SLA applies for MEDIUM, so go straight to the 365-day remediation window, but given the legacy status you should prioritize the upgrade.
3. Upgrade legacy clusters to 3.10.8.3 or 4.0.3.17 — This is the definitive fix. Any cluster still on pre-3.6 code has been out of support for years and is also vulnerable to CVE-2026-20223 (May 2026). Upgrading addresses both CVEs and restores TAC support eligibility. Plan the upgrade within the noisgate 365-day remediation SLA for MEDIUM, though operational hygiene argues for doing it much sooner.
4. Monitor Secure Workload audit logs for anomalous API activity — Enable and forward audit logs from your Secure Workload cluster to your SIEM. Alert on unauthenticated API calls or unexpected configuration changes. This provides detection-in-depth while you plan the upgrade.

Run this script on each Secure Workload cluster node (or against the cluster's API endpoint from an auditor workstation). Requires SSH access to the cluster or API access to query the version. No elevated privileges needed for the version check. Example: bash check_csw_cve2026-20317.sh

#!/usr/bin/env bash
# check_csw_cve2026-20317.sh
# Checks whether a Cisco Secure Workload cluster is vulnerable to CVE-2026-20317
# Affected versions: 1.103.1.12 through 3.5.1.30
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Attempt to get version from the local cluster node
VERSION=""

# Method 1: Check via RPM package (on-prem appliance)
if command -v rpm &>/dev/null; then
  VERSION=$(rpm -q --queryformat '%{VERSION}' tetration-os 2>/dev/null || true)
fi

# Method 2: Check via the version file
if [[ -z "$VERSION" ]] && [[ -f /etc/tetration/version ]]; then
  VERSION=$(cat /etc/tetration/version 2>/dev/null || true)
fi

# Method 3: Check via cluster info API (if CLUSTER_URL is set)
if [[ -z "$VERSION" ]] && [[ -n "${CSW_CLUSTER_URL:-}" ]]; then
  VERSION=$(curl -sk "${CSW_CLUSTER_URL}/api/v1/cluster/version" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - Could not determine Cisco Secure Workload version."
  echo "Set CSW_CLUSTER_URL env var or run on a cluster node."
  exit 2
fi

echo "Detected Secure Workload version: $VERSION"

# Parse major.minor for comparison
# Affected: 1.103.1.12 through 3.5.1.30
# Not affected: 3.6.x and later (3.10.x, 4.0.x)
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)

if [[ "$MAJOR" -lt 1 ]]; then
  echo "UNKNOWN - Version $VERSION is below known range."
  exit 2
elif [[ "$MAJOR" -eq 1 ]]; then
  # All 1.x versions in range are affected
  echo "VULNERABLE - Version $VERSION is in the affected range (1.103.1.12 - 3.5.1.30)."
  echo "Upgrade to 3.10.8.3 or 4.0.3.17 immediately."
  exit 1
elif [[ "$MAJOR" -eq 2 ]]; then
  echo "VULNERABLE - Version $VERSION is in the affected range (1.103.1.12 - 3.5.1.30)."
  echo "Upgrade to 3.10.8.3 or 4.0.3.17 immediately."
  exit 1
elif [[ "$MAJOR" -eq 3 ]]; then
  if [[ "$MINOR" -le 5 ]]; then
    echo "VULNERABLE - Version $VERSION is in the affected range (1.103.1.12 - 3.5.1.30)."
    echo "Upgrade to 3.10.8.3 or 4.0.3.17 immediately."
    exit 1
  else
    echo "PATCHED - Version $VERSION is outside the affected range."
    exit 0
  fi
elif [[ "$MAJOR" -ge 4 ]]; then
  echo "PATCHED - Version $VERSION is outside the affected range."
  exit 0
else
  echo "UNKNOWN - Could not parse version $VERSION."
  exit 2
fi

Sources

1. NVD - CVE-2026-20317
2. Cisco Advisory: Secure Workload Unauthorized API Access (CVE-2026-20223)
3. SecurityWeek - Cisco Patches Critical Vulnerability in Secure Workload
4. Cisco Secure Workload Software Support Policy
5. Cisco Secure Workload End-of-Life Notices
6. The Hacker News - Cisco Patches CVSS 10.0 Secure Workload REST API Flaw
7. SOCRadar - CVE-2026-20223 Cisco Secure Workload Auth Bypass