LiveActive security incident?Get immediate response
CVE Record

CVE-2026-20317: Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20317 are related to improper authentication issues that are grouped under the Common Weakness Enumeration (CWE) CWE-287.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Cisco found multiple authentication weaknesses in Secure Workload during an internal review. A network-reachable, unauthenticated attacker may be able to make high-impact changes or disrupt service. The CVSS score is 10.0, but the supplied evidence does not indicate confidentiality loss or confirmed exploitation.

Executive priority

Prioritize emergency assessment and vendor-directed remediation. The maximum CVSS score and unauthenticated network vector justify urgent action, especially where management services are broadly reachable. Coordinate availability safeguards because the stated impact includes service disruption.

Technical view

CVE-2026-20317 groups internally discovered CWE-287 improper-authentication vulnerabilities in Cisco Secure Workload. Cisco assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H, indicating remote, low-complexity, unauthenticated impact to integrity and availability across a changed security scope.

Likely exposure

Organizations running any listed Cisco Secure Workload build should treat it as potentially affected. Network reachability increases risk because the vector is network-based and requires neither privileges nor user interaction. The bundle does not identify exposed interfaces, deployment prerequisites, or a definitive fixed-version boundary.

Exploitation context

The bundle reports internal discovery and does not provide evidence of public exploitation. The CVE is not marked as included in CISA KEV. Absence from KEV does not prove that exploitation is impossible or has not occurred.

Researcher notes

The record groups multiple improper-authentication issues under one CVE and supplies no endpoint, protocol, root-cause, or fixed-version detail. The scope-changing vector asserts high integrity and availability impact without confidentiality impact. Avoid inferring code execution, data theft, or exploitation from the available evidence.

Mitigation direction

  • Review Cisco's advisory immediately for supported fixed releases and upgrade instructions.
  • Restrict Secure Workload management access to trusted administrative networks while remediation is pending.
  • Apply least-privilege network controls around affected systems and monitor denied access attempts.
  • Follow Cisco guidance for any deployment-specific mitigations; none are detailed in the supplied bundle.

Validation and detection

  • Inventory all Cisco Secure Workload deployments and record their exact software builds.
  • Compare each build with Cisco's current advisory and confirm its remediation status.
  • Verify management interfaces are unreachable from untrusted networks.
  • Review authentication, configuration-change, and service-health logs for unexplained activity or disruption.
  • After upgrading, confirm the installed version and retest authorized administrative access.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-287: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-20317 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H3.95.8cisco

Vulnerability scoring details

Base CVSS 3.1 score

10Critical
CVSS 3.1 vector shape for CVE-2026-20317Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVEADP container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
CiscoCisco Secure Workload2.2.1.41, 3.2.1.18, 3.3.2.50, 3.4.1.28, 3.4.1.34, 2.3.1.45, 2.3.1.41, 3.3.2.28, 3.1.1.59, 2.0.2.20, 2.1.1.33, 2.1.1.29, 3.2.1.28, 3.4.1.35, 3.1.1.65, 3.1.1.67, 2.0.1.34, 2.3.1.49, 2.2.1.39, 3.4.1.19, 3.3.2.23, 3.1.1.61, 3.1.1.54, 3.5.1.17, 3.3.2.33, 3.5.1.1, 2.3.1.53, 3.5.1.20, 3.5.1.30, 3.3.2.16, 3.1.1.55, 3.4.1.6, 2.3.1.50, 2.3.1.52, 3.2.1.19, 2.2.1.35, 3.1.1.53, 3.1.1.70, 3.2.1.20, 3.5.1.2, 1.103.1.12, 2.3.1.51, 3.3.2.42, 3.4.1.1, 3.3.2.12, 2.1.1.31, 3.5.1.23, 3.3.2.53, 3.4.1.14, 3.3.2.2, 3.4.1.20, 3.3.2.35, 2.2.1.34, 1.102.21, 3.3.2.5, 3.5.1.31, 3.6.1.5, 3.2.1.31, 3.5.1.37, 3.4.1.40, 3.6.1.17, 3.6.1.21, 3.2.1.32, 3.2.1.33, 3.6.1.35, 3.6.1.36, 3.7.1.5, 3.6.1.47, 3.7.1.22, 3.6.1.52, 3.7.1.39, 3.8.1.1, 3.7.1.51, 3.8.1.19, 3.8.1.36, 3.7.1.59, 3.8.1.39, 3.9.1.1, 3.9.1.10, 3.9.1.24, 3.9.1.25, 3.9.1.28, 3.9.1.38, 3.8.1.53, 3.9.1.52, 3.10.1.1, 3.9.1.64, 3.10.2.11, 3.9.1.66, 3.10.3.19, 3.9.1.69, 3.10.4.8, 3.10.5.6, 4.0.1.1, 4.0.2.4, 4.0.2.5, 3.10.6.3, 3.10.7.4, 4.0.3.13, 4.0.3.17, 3.10.8.3unknown
Weakness

CWE details

CWE-287

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-287 · source CWE mapping

Improper Authentication

Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs