Full Report
Secure Workload Software has five nasty flaws and even SaaS users have updates to install
Analysis Summary
# Vulnerability: Multiple Critical Vulnerabilities in Cisco Secure Workload (Tetration)
## CVE Details
* **CVE-2026-20315**: 10.0 (Critical) - Improper Access Control
* **CVE-2026-20317**: 10.0 (Critical) - Improper Access Control
* **CVE-2026-20231**: 9.9 (Critical) - Improper Neutralization of Special Elements
* **CVE-2026-20318**: 9.6 (Critical) - Improper Input Validation
* **CVE-2026-20319**: 7.5 (High) - Memory Safety (Buffer Overflow/Out-of-bounds Write)
## Affected Systems
* **Products**: Cisco Secure Workload (formerly Tetration) - SaaS and On-Premise deployments.
* **Versions**:
* On-Premise: Version 3.10 and earlier.
* On-Premise: Version 4.0 and later (prior to 4.0.4.16).
* SaaS: Agent and Connector tools.
* **Configurations**: Micro-segmentation environments utilizing Secure Workload Agents and Connectors.
## Vulnerability Description
Cisco identified five vulnerabilities through internal security reviews using "frontier AI models."
* **CVE-2026-20315 & 20317**: These critical flaws involve authorization and authentication bypasses, as well as reliance on untrusted inputs, potentially allowing unauthenticated access to the system.
* **CVE-2026-20231**: This flaw permits OS command, argument, or command injection due to improper neutralization of special elements.
* **CVE-2026-20318**: A high-severity input validation flaw that could lead to unexpected system behavior.
* **CVE-2026-20319**: A memory management flaw involving buffer overflows and out-of-bounds writes.
## Exploitation
* **Status**: Not exploited (No malicious use detected in the wild).
* **Complexity**: Low to Medium (based on high CVSS scores).
* **Attack Vector**: Network (Remote).
## Impact
* **Confidentiality**: High (Complete bypass of authorization).
* **Integrity**: High (Potential for OS command injection).
* **Availability**: High (Memory buffer issues can lead to system crashes).
## Remediation
### Patches
Cisco has released the following updates to address these vulnerabilities:
* **On-Premise (3.x branches)**: Upgrade to version **3.10.9.1**.
* **On-Premise (4.x branches)**: Upgrade to version **4.0.4.16**.
* **SaaS Users**: While the backend is patched, users **must** upgrade their local **Agent and Connector tools** to the latest versions.
### Workarounds
* No specific workarounds were provided in the advisory; immediate patching/upgrading is the recommended course of action.
## Detection
* **Indicators of Compromise**: Monitor for unauthorized access attempts to the Secure Workload dashboard or unusual command executions on systems hosting the Secure Workload Agent.
* **Detection methods**: Audit system logs for authentication bypass attempts and validate the versioning of all deployed Agents and Connectors using the central management console.
## References
* Cisco Security Advisory: hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP