Is CVE-2026-20317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20317 being exploited in the wild.

How severe is CVE-2026-20317?

Critical severity, with a CVSS score of 10, published 19 August 2026.

Which products and versions are affected?

Cisco Secure Workload 3.10 and earlier, 4.0 before 4.0.4.16.

Is there a fix for CVE-2026-20317?

A patch was published on 2026-08-19: Fixed releases: 3.10.9.1 and 4.0.4.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20317 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20317?

Check whether you run Cisco Secure Workload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20317: Cisco Secure Workload authentication bypass

CVE-2026-20317 · Severity: critical · CVSS 10 · Published 2026-08-19

Cisco Secure Workload, a security monitoring and compliance platform, contains multiple critical authentication and access control vulnerabilities discovered during internal security review. An attacker with network access could bypass authentication or gain unauthorized access to sensitive security data and system controls without credentials, potentially compromising the entire security posture of an organization's infrastructure.

Technologies: Cisco Secure Workload. Vendors: Cisco.

Quick answers

Is CVE-2026-20317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20317 being exploited in the wild.
How severe is CVE-2026-20317?: Critical severity, with a CVSS score of 10, published 19 August 2026.
Which products and versions are affected?: Cisco Secure Workload 3.10 and earlier, 4.0 before 4.0.4.16.
Is there a fix for CVE-2026-20317?: A patch was published on 2026-08-19: Fixed releases: 3.10.9.1 and 4.0.4.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20317 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20317?: Check whether you run Cisco Secure Workload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Cisco Secure Workload contains multiple vulnerabilities grouped under CWE-287 (improper authentication) and related CWE-284 (improper access control). The vulnerabilities allow remote attackers without authentication (no PR, no UI required) to achieve complete compromise across the system confidentiality, integrity, and availability via network attack. Root cause involves authentication bypass, missing authentication checks, or reliance on untrusted inputs. The advisory covers multiple weakness classes (CWE-119, CWE-20, CWE-284, CWE-287, CWE-74) affecting both SaaS and on-premises deployments. Patches are available: upgrade to Secure Workload 3.10.9.1 or 4.0.4.16 and update Cluster, Agent, and Connector software. No workarounds are available.

Affected products

Cisco Secure Workload 3.10 and earlier, 4.0 before 4.0.4.16

Timeline

2026-08-19: disclosed
2026-08-19: patched: Fixed releases: 3.10.9.1 and 4.0.4.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.