Cisco has issued an advisory regarding five vulnerabilities discovered in its Secure Workload Software, a micro-segmentation tool previously known as Tetration. These flaws, identified during an internal security review that included the use of advanced AI models, range in severity from critical to high. Cisco confirmed that it has not observed any malicious exploitation of these vulnerabilities in the wild.
Among the most severe are two critical flaws, CVE-2026-20315 and CVE-2026-20317, both rated 10.0 on the CVSS scale. CVE-2026-20315 involves improper access control, encompassing issues with authorization, authentication, privileges, and bypasses. CVE-2026-20317 also relates to improper access control, specifically citing missing authentication, authentication bypass, and reliance on untrusted inputs.
Another critical vulnerability, CVE-2026-20231, received a CVSS score of 9.9. This flaw is described as an improper neutralization of special elements, which can lead to command, OS, or argument injection. Following this is CVE-2026-20318, rated 9.6, which stems from improper input validation.
The fifth vulnerability, CVE-2026-20319, is rated 7.5 and is considered high severity. It involves improper restriction of operations within the bounds of a memory buffer, potentially leading to overflows and out-of-bounds writes.
Cisco Secure Workload Software is available as both a Software-as-a-Service (SaaS) and an on-premise deployment. For SaaS users, Cisco has already patched the core service, but customers are still required to update their Agent and Connector tools to ensure full protection.
On-premise users need to take specific update actions based on their current version. Those running version 3.10 or earlier must upgrade to version 3.10.9.1. Users operating version 4.0 or later should update to version 4.0.4.16. The company emphasized the importance of applying these updates promptly.
Cisco's internal security review that uncovered these flaws reportedly leveraged "frontier AI models," which may include advanced tools like Anthropic’s Mythos bug-finding model, given Cisco's participation in Project Glasswing.
