CVE-2026-20319 - Vulnerability Details

- Cisco Secure Workload Software Security Hardening Release August 2026 - Buffer Management Vulnerabilities

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20319 are related to buffer management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-119.

Published: 2026-08-19

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The advisory describes buffer management flaws classified as CWE-119, which can lead to memory corruption when Cisco Secure Workload processes data. While the impact scope is not explicitly detailed, it is inferred that such corruption could trigger application crashes or lead to denial of service. The description does not state that arbitrary code execution is possible, so the primary consequence remains memory corruption and potential service disruption.

Affected Systems

The vulnerability affects Cisco Secure Workload. No specific version information is provided in the advisory and the hardening release addresses multiple internally discovered issues within this product.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity level, yet the EPSS score is reported as < 1%, implying a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. No attack vector is disclosed in the advisory, making it unclear whether remote or local access is required for exploitation. The high severity suggests a significant potential impact once the flaw is triggered, but the low exploitation probability reduces the immediate threat level.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Secure Workload

unknown

Version	Status	Constraints
`2.2.1.41`	affected	—
`3.2.1.18`	affected	—
`3.3.2.50`	affected	—
`3.4.1.28`	affected	—
`3.4.1.34`	affected	—
`2.3.1.45`	affected	—
`2.3.1.41`	affected	—
`3.3.2.28`	affected	—
`3.1.1.59`	affected	—
`2.0.2.20`	affected	—
`2.1.1.33`	affected	—
`2.1.1.29`	affected	—
`3.2.1.28`	affected	—
`3.4.1.35`	affected	—
`3.1.1.65`	affected	—
`3.1.1.67`	affected	—
`2.0.1.34`	affected	—
`2.3.1.49`	affected	—
`2.2.1.39`	affected	—
`3.4.1.19`	affected	—
`3.3.2.23`	affected	—
`3.1.1.61`	affected	—
`3.1.1.54`	affected	—
`3.5.1.17`	affected	—
`3.3.2.33`	affected	—
`3.5.1.1`	affected	—
`2.3.1.53`	affected	—
`3.5.1.20`	affected	—
`3.5.1.30`	affected	—
`3.3.2.16`	affected	—
`3.1.1.55`	affected	—
`3.4.1.6`	affected	—
`2.3.1.50`	affected	—
`2.3.1.52`	affected	—
`3.2.1.19`	affected	—
`2.2.1.35`	affected	—
`3.1.1.53`	affected	—
`3.1.1.70`	affected	—
`3.2.1.20`	affected	—
`3.5.1.2`	affected	—
`1.103.1.12`	affected	—
`2.3.1.51`	affected	—
`3.3.2.42`	affected	—
`3.4.1.1`	affected	—
`3.3.2.12`	affected	—
`2.1.1.31`	affected	—
`3.5.1.23`	affected	—
`3.3.2.53`	affected	—
`3.4.1.14`	affected	—
`3.3.2.2`	affected	—
`3.4.1.20`	affected	—
`3.3.2.35`	affected	—
`2.2.1.34`	affected	—
`1.102.21`	affected	—
`3.3.2.5`	affected	—
`3.5.1.31`	affected	—
`3.6.1.5`	affected	—
`3.2.1.31`	affected	—
`3.5.1.37`	affected	—
`3.4.1.40`	affected	—
`3.6.1.17`	affected	—
`3.6.1.21`	affected	—
`3.2.1.32`	affected	—
`3.2.1.33`	affected	—
`3.6.1.35`	affected	—
`3.6.1.36`	affected	—
`3.7.1.5`	affected	—
`3.6.1.47`	affected	—
`3.7.1.22`	affected	—
`3.6.1.52`	affected	—
`3.7.1.39`	affected	—
`3.8.1.1`	affected	—
`3.7.1.51`	affected	—
`3.8.1.19`	affected	—
`3.8.1.36`	affected	—
`3.7.1.59`	affected	—
`3.8.1.39`	affected	—
`3.9.1.1`	affected	—
`3.9.1.10`	affected	—
`3.9.1.24`	affected	—
`3.9.1.25`	affected	—
`3.9.1.28`	affected	—
`3.9.1.38`	affected	—
`3.8.1.53`	affected	—
`3.9.1.52`	affected	—
`3.10.1.1`	affected	—
`3.9.1.64`	affected	—
`3.10.2.11`	affected	—
`3.9.1.66`	affected	—
`3.10.3.19`	affected	—
`3.9.1.69`	affected	—
`3.10.4.8`	affected	—
`3.10.5.6`	affected	—
`4.0.1.1`	affected	—
`4.0.2.4`	affected	—
`4.0.2.5`	affected	—
`3.10.6.3`	affected	—
`3.10.7.4`	affected	—
`4.0.3.13`	affected	—
`4.0.3.17`	affected	—
`3.10.8.3`	affected	—

No data.

Vendor Product Confidence Versions

Cisco

Secure Workload

88%

Version	Status	Scheme	Platform
`2.2.1.41`	affected	generic	—
`3.2.1.18`	affected	generic	—
`3.3.2.50`	affected	generic	—
`3.4.1.28`	affected	generic	—
`3.4.1.34`	affected	generic	—
`2.3.1.45`	affected	generic	—
`2.3.1.41`	affected	generic	—
`3.3.2.28`	affected	generic	—
`3.1.1.59`	affected	generic	—
`2.0.2.20`	affected	generic	—
`2.1.1.33`	affected	generic	—
`2.1.1.29`	affected	generic	—
`3.2.1.28`	affected	generic	—
`3.4.1.35`	affected	generic	—
`3.1.1.65`	affected	generic	—
`3.1.1.67`	affected	generic	—
`2.0.1.34`	affected	generic	—
`2.3.1.49`	affected	generic	—
`2.2.1.39`	affected	generic	—
`3.4.1.19`	affected	generic	—
`3.3.2.23`	affected	generic	—
`3.1.1.61`	affected	generic	—
`3.1.1.54`	affected	generic	—
`3.5.1.17`	affected	generic	—
`3.3.2.33`	affected	generic	—
`3.5.1.1`	affected	generic	—
`2.3.1.53`	affected	generic	—
`3.5.1.20`	affected	generic	—
`3.5.1.30`	affected	generic	—
`3.3.2.16`	affected	generic	—
`3.1.1.55`	affected	generic	—
`3.4.1.6`	affected	generic	—
`2.3.1.50`	affected	generic	—
`2.3.1.52`	affected	generic	—
`3.2.1.19`	affected	generic	—
`2.2.1.35`	affected	generic	—
`3.1.1.53`	affected	generic	—
`3.1.1.70`	affected	generic	—
`3.2.1.20`	affected	generic	—
`3.5.1.2`	affected	generic	—
`1.103.1.12`	affected	generic	—
`2.3.1.51`	affected	generic	—
`3.3.2.42`	affected	generic	—
`3.4.1.1`	affected	generic	—
`3.3.2.12`	affected	generic	—
`2.1.1.31`	affected	generic	—
`3.5.1.23`	affected	generic	—
`3.3.2.53`	affected	generic	—
`3.4.1.14`	affected	generic	—
`3.3.2.2`	affected	generic	—
`3.4.1.20`	affected	generic	—
`3.3.2.35`	affected	generic	—
`2.2.1.34`	affected	generic	—
`1.102.21`	affected	generic	—
`3.3.2.5`	affected	generic	—
`3.5.1.31`	affected	generic	—
`3.6.1.5`	affected	generic	—
`3.2.1.31`	affected	generic	—
`3.5.1.37`	affected	generic	—
`3.4.1.40`	affected	generic	—
`3.6.1.17`	affected	generic	—
`3.6.1.21`	affected	generic	—
`3.2.1.32`	affected	generic	—
`3.2.1.33`	affected	generic	—
`3.6.1.35`	affected	generic	—
`3.6.1.36`	affected	generic	—
`3.7.1.5`	affected	generic	—
`3.6.1.47`	affected	generic	—
`3.7.1.22`	affected	generic	—
`3.6.1.52`	affected	generic	—
`3.7.1.39`	affected	generic	—
`3.8.1.1`	affected	generic	—
`3.7.1.51`	affected	generic	—
`3.8.1.19`	affected	generic	—
`3.8.1.36`	affected	generic	—
`3.7.1.59`	affected	generic	—
`3.8.1.39`	affected	generic	—
`3.9.1.1`	affected	generic	—
`3.9.1.10`	affected	generic	—
`3.9.1.24`	affected	generic	—
`3.9.1.25`	affected	generic	—
`3.9.1.28`	affected	generic	—
`3.9.1.38`	affected	generic	—
`3.8.1.53`	affected	generic	—
`3.9.1.52`	affected	generic	—
`3.10.1.1`	affected	generic	—
`3.9.1.64`	affected	generic	—
`3.10.2.11`	affected	generic	—
`3.9.1.66`	affected	generic	—
`3.10.3.19`	affected	generic	—
`3.9.1.69`	affected	generic	—
`3.10.4.8`	affected	generic	—
`3.10.5.6`	affected	generic	—
`4.0.1.1`	affected	generic	—
`4.0.2.4`	affected	generic	—
`4.0.2.5`	affected	generic	—
`3.10.6.3`	affected	generic	—
`3.10.7.4`	affected	generic	—
`4.0.3.13`	affected	generic	—
`4.0.3.17`	affected	generic	—
`3.10.8.3`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Download and deploy the Cisco Secure Workload hardening release August 2026 released under the Cisco Security Advisory cisco-sa-hardening-csw1-shSvndWP.
Follow Cisco’s installation guide to replace the vulnerable binaries and restart the affected services, ensuring that the updated binaries are in use.
Apply a temporary network segmentation rule that limits inbound traffic to services that consume untrusted input until the patch has been confirmed to mitigate the risk of buffer overrun exploitation.

Generated by OpenCVE AI on August 20, 2026 at 14:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00367.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP
https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification

History

Thu, 20 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco secure Workload
Vendors & Products		Cisco Cisco secure Workload

Wed, 19 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 19 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
References		https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification

Wed, 19 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20319 are related to buffer management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-119.
Title		Cisco Secure Workload Software Security Hardening Release August 2026 - Buffer Management Vulnerabilities
Weaknesses		CWE-119
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Cisco Secure Workload

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-08-19T16:19:44.681Z

Updated: 2026-08-19T19:35:32.543Z

Reserved: 2025-10-08T11:59:15.410Z

Link: CVE-2026-20319

Vulnrichment

Updated: 2026-08-19T18:31:51.184Z

NVD

Status : Awaiting Analysis

Published: 2026-08-19T17:18:40.280

Modified: 2026-08-20T13:01:19.947

Link: CVE-2026-20319

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-20T14:45:16Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object