Cisco Releases Updates for Critical Secure Workload Vulnerability
NEOSEC enrichment — no mirror of the original source
On Wednesday, May 20, Cisco released updates to address a critical unauthorized API access vulnerability in Cisco Secure Workload (CVE-2026-20223). In the advisory, Cisco writes, "This vulnerability is due to insufficient validation and aut
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
- CVE-2026-20171A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switc…
- CVE-2026-20223A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site r…
- CVE-2026-20199A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to execute commands on …
- CVE-2026-20206A vulnerability in the BrowserBot component of Cisco ThousandEyes Enterprise Agent could have allowed an authenticated, remote attacker to execute arbitrary …
Affected vendors and products
More on Releases
Other advisories
- CriticalCVE-2026-106071Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases
- Not ratedosv:CVE-2026-94018NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
- Criticalpwn_watch:ovhcloud-cli-github-infostealerOVHcloud CLI releases backdoored on GitHub
- HighCVE-2026-105267Gitea tag delete route deletes releases without release permission
- Not ratedosv:CVE-2026-105267Gitea tag delete route deletes releases without release permission
- HighCVE-2026-101322In Eclipse BaSyx AAS Web UI-Versionen v2-241220 bis zu den vor v2-260924 erschienenen Releases wurde der gemeinsam genutzte Anfrage-Handler ...
- Not ratedosv:ECHO-3cde-a058-b750HttpContentDecompressor's maxAllocation limit is enforced for gzip/deflate but ignored for br/zstd/snappy — but maxAllocation doesn't exist at all in 4.1.110.Final; introduced in 4.1.122.Final, 12 releases later. Nothing exists yet to bypass. https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv
- HighCVE-2026-27660Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
Other news entries
- Cisco Advance Notification for Publication of November 4, 2026, Security AdvisoriesNewsCisco PSIRT
- Microsoft releases Windows OOB updates to distrust eMudhra certificatesNewsBleepingComputer
- Microsoft releases out-of-band Windows fixes with certificate updatesNewsThe Register — Security
- Microsoft releases emergency .NET security fixes for Google Brotli bugNewsThe Register — Security
- Microsoft releases emergency .NET patches for critical Brotli flawNewsBleepingComputer
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token BalancesNewsThe Hacker News
- Multiple Cisco Products Snort 3 Security Hardening Release: October 2026NewsCisco PSIRT
- Max-severity GitLab bug allows remote code execution over 12 years of releasesNewsThe Register — Security
Source: https://www.theregister.com/
ID