Cisco bug severity warning reads like Olympic gymnastics scores: 10, 10, 9.9, 9.6, and 7.5.
Secure Workload Software has five nasty flaws and even SaaS users have updates to install
Cisco has identified four critical vulnerabilities and one high-severity flaw in its Secure Workload Software, a micro-segmentation tool. The two most severe bugs, CVE-2026-20315 and CVE-2026-20317, are rated a perfect 10 on the Common Vulnerability Scoring System, indicating they allow attackers to bypass authentication, authorization, and privileges, or rely on untrusted inputs.
Another bug, CVE-2026-20231, is rated 9.9 and relates to improper neutralization of special elements, which can lead to command, OS, or argument injection. The 9.6-rated flaw, CVE-2026-20318, is an improper input validation issue. Lastly, CVE-2026-20319, rated 7.5, stems from improper restriction of operations within memory buffers, potentially resulting in overflows and out-of-bounds writes.
Cisco has patched these flaws in its SaaS version, but users must upgrade their Agent and Connector tools to utilize the cloud-based software. On-premise users with versions 3.10 or earlier need to upgrade to 3.10.9.1, while those on versions 4.0 or later should update to 4.0.4.16. Cisco discovered the vulnerabilities through an internal security review involving existing processes and frontier AI models.
The company has not detected any malicious use of the vulnerabilities.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
