# Cisco Secure Workload: update agents and connectors as well as clusters

Canonical: https://www.oktsec.com/radar/cisco-secure-workload-august-2026-security-hardening
Publisher: Oktsec
Language: en
Published: 2026-11-14T16:00:33Z
Updated: 2026-11-14T16:00:33Z
Record reviewed: 2026-11-14T16:00:33Z
Latest evidence check: 2026-11-14T16:00:33Z
Disclosed: 2026-08-19

Cisco’s security release covers clusters, agents and connectors, including SaaS deployments. Cisco updated SaaS clusters, but customers still need to update their agents and connectors.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: Cisco rates these grouped flaws critical and provides fixes. The vendor does not report exploitation; prioritize affected deployments without presenting the August disclosure as a new attack.
- Evidence: No attacks reported
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Cisco
- Products: Cisco Secure Workload
- CVEs: CVE-2026-20231, CVE-2026-20315, CVE-2026-20317, CVE-2026-20318, CVE-2026-20319

## Technical overview

The August 19 advisory includes CVE-2026-20317 and four other identifiers grouping authentication, access control, injection, input validation and memory issues. Cisco reports no known malicious use and no workaround.

All deployment configurations are in scope. SaaS customers should not interpret the provider’s cluster update as completion of their own agent and connector updates.

## Recommended response

Upgrade to 3.10.9.1 or 4.0.4.16 on the applicable branch, or a later corrected release. Verify cluster, agent and connector versions separately.

Relevant to: Administrators of Cisco Secure Workload.

## CVE attribution

- CVE-2026-20231: Cisco — Cisco Secure Workload. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20231.json)
- CVE-2026-20315: Cisco — Cisco Secure Workload. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20315.json)
- CVE-2026-20317: Cisco — Cisco Secure Workload. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20317.json)
- CVE-2026-20318: Cisco — Cisco Secure Workload. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20318.json)
- CVE-2026-20319: Cisco — Cisco Secure Workload. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20319.json)

## Affected systems and fixes

### Secure Workload 3.10 and earlier

Affected: Releases without the 3.10.9.1 correction

Fixed release / action: 3.10.9.1

### Secure Workload 4.0

Affected: Releases before 4.0.4.16

Fixed release / action: 4.0.4.16

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.13
Checked: 2026-11-14T16:03:56.845Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-20319](https://api.first.org/data/v1/epss?cve=CVE-2026-20319): 0.47% probability of observed exploitation in the next 30 days; percentile 41.02%; score date 2026-11-14.
- [CVE-2026-20318](https://api.first.org/data/v1/epss?cve=CVE-2026-20318): 0.44% probability of observed exploitation in the next 30 days; percentile 38.85%; score date 2026-11-14.
- [CVE-2026-20317](https://api.first.org/data/v1/epss?cve=CVE-2026-20317): 0.56% probability of observed exploitation in the next 30 days; percentile 47.02%; score date 2026-11-14.
- [CVE-2026-20315](https://api.first.org/data/v1/epss?cve=CVE-2026-20315): 0.49% probability of observed exploitation in the next 30 days; percentile 42.75%; score date 2026-11-14.
- [CVE-2026-20231](https://api.first.org/data/v1/epss?cve=CVE-2026-20231): 0.53% probability of observed exploitation in the next 30 days; percentile 45.15%; score date 2026-11-14.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z.

### Official regional advisories

- [Vulnerabilidades en productos Cisco](https://www.cert.gov.py/vulnerabilidades-en-productos-cisco-19/) — CERT-PY, Paraguay; publication 2026-11-12T13:14:50.000Z; observed 2026-11-14T21:07:37.491Z; matched by exact CVE identifier.

Publisher country does not establish victim location. Original notices may repeat the same underlying advisory.

## Response checklist

1. **Identify deployment ownership** — Separate SaaS components managed by Cisco from agents and connectors managed by your team.
2. **Complete all component updates** — For installations you operate, update Cluster, Agent and Connector software. For SaaS, update the Agent and Connector components.
3. **Verify running versions** — Oktsec recommends checking the actual versions across the deployment, rather than only the management interface.

## Relevance to AI environments

Verify the software and permissions behind automated operations.

## Sources

- [Affected products, fixed releases and exploitation status](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP) — Cisco; Vendor notice; checked 2026-11-14T16:00:33Z
- [CNA product scope for CVE-2026-20231](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20231.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z
- [CNA product scope for CVE-2026-20315](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20315.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z
- [CNA product scope for CVE-2026-20317](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20317.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z
- [CNA product scope for CVE-2026-20318](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20318.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z
- [CNA product scope for CVE-2026-20319](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20319.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z

## Editorial record

- 2026-11-14T16:00:33Z: Added affected scope, verified corrections and limits of the available evidence.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/cisco-secure-workload-august-2026-security-hardening) · [Build a response plan](https://www.oktsec.com/radar/cisco-secure-workload-august-2026-security-hardening#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-secure-workload-august-2026-security-hardening&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-secure-workload-august-2026-security-hardening&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.