Read the docs
TI-2026-16504 Aliases CVE-2026-20318GHSA-cjg6-c7q5-6vpx

Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Validation Vulnerabilities

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20318 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Secure Workload2.2.1.41; 3.2.1.18; 3.3.2.50; 3.4.1.28; 3.4.1.34; 2.3.1.45; 2.3.1.41; 3.3.2.28; 3.1.1.59; 2.0.2.20; 2.1.1.33; 2.1.1.29; 3.2.1.28; 3.4.1.35; 3.1.1.65; 3.1.1.67; 2.0.1.34; 2.3.1.49; 2.2.1.39; 3.4.1.19; 3.3.2.23; 3.1.1.61; 3.1.1.54; 3.5.1.17; 3.3.2.33; 3.5.1.1; 2.3.1.53; 3.5.1.20; 3.5.1.30; 3.3.2.16; 3.1.1.55; 3.4.1.6; 2.3.1.50; 2.3.1.52; 3.2.1.19; 2.2.1.35; 3.1.1.53; 3.1.1.70; 3.2.1.20; 3.5.1.2; 1.103.1.12; 2.3.1.51; 3.3.2.42; 3.4.1.1; 3.3.2.12; 2.1.1.31; 3.5.1.23; 3.3.2.53; 3.4.1.14; 3.3.2.2; 3.4.1.20; 3.3.2.35; 2.2.1.34; 1.102.21; 3.3.2.5; 3.5.1.31; 3.6.1.5; 3.2.1.31; 3.5.1.37; 3.4.1.40; 3.6.1.17; 3.6.1.21; 3.2.1.32; 3.2.1.33; 3.6.1.35; 3.6.1.36; 3.7.1.5; 3.6.1.47; 3.7.1.22; 3.6.1.52; 3.7.1.39; 3.8.1.1; 3.7.1.51; 3.8.1.19; 3.8.1.36; 3.7.1.59; 3.8.1.39; 3.9.1.1; 3.9.1.10; 3.9.1.24; 3.9.1.25; 3.9.1.28; 3.9.1.38; 3.8.1.53; 3.9.1.52; 3.10.1.1; 3.9.1.64; 3.10.2.11; 3.9.1.66; 3.10.3.19; 3.9.1.69; 3.10.4.8; 3.10.5.6; 4.0.1.1; 4.0.2.4; 4.0.2.5; 3.10.6.3; 3.10.7.4; 4.0.3.13; 4.0.3.17; 3.10.8.3—No fix listedCNA
  • Cisco Secure Workload VendorCisco Affected 2.2.1.41; 3.2.1.18; 3.3.2.50; 3.4.1.28; 3.4.1.34; 2.3.1.45; 2.3.1.41; 3.3.2.28; 3.1.1.59; 2.0.2.20; 2.1.1.33; 2.1.1.29; 3.2.1.28; 3.4.1.35; 3.1.1.65; 3.1.1.67; 2.0.1.34; 2.3.1.49; 2.2.1.39; 3.4.1.19; 3.3.2.23; 3.1.1.61; 3.1.1.54; 3.5.1.17; 3.3.2.33; 3.5.1.1; 2.3.1.53; 3.5.1.20; 3.5.1.30; 3.3.2.16; 3.1.1.55; 3.4.1.6; 2.3.1.50; 2.3.1.52; 3.2.1.19; 2.2.1.35; 3.1.1.53; 3.1.1.70; 3.2.1.20; 3.5.1.2; 1.103.1.12; 2.3.1.51; 3.3.2.42; 3.4.1.1; 3.3.2.12; 2.1.1.31; 3.5.1.23; 3.3.2.53; 3.4.1.14; 3.3.2.2; 3.4.1.20; 3.3.2.35; 2.2.1.34; 1.102.21; 3.3.2.5; 3.5.1.31; 3.6.1.5; 3.2.1.31; 3.5.1.37; 3.4.1.40; 3.6.1.17; 3.6.1.21; 3.2.1.32; 3.2.1.33; 3.6.1.35; 3.6.1.36; 3.7.1.5; 3.6.1.47; 3.7.1.22; 3.6.1.52; 3.7.1.39; 3.8.1.1; 3.7.1.51; 3.8.1.19; 3.8.1.36; 3.7.1.59; 3.8.1.39; 3.9.1.1; 3.9.1.10; 3.9.1.24; 3.9.1.25; 3.9.1.28; 3.9.1.38; 3.8.1.53; 3.9.1.52; 3.10.1.1; 3.9.1.64; 3.10.2.11; 3.9.1.66; 3.10.3.19; 3.9.1.69; 3.10.4.8; 3.10.5.6; 4.0.1.1; 4.0.2.4; 4.0.2.5; 3.10.6.3; 3.10.7.4; 4.0.3.13; 4.0.3.17; 3.10.8.3 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-20318
  2. 2026-10-03 Alias added: GHSA-cjg6-c7q5-6vpx

References

Other 1

  • TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences