SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20315

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 10 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

10

Technische Schwere

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20315 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Die Schwachstelle CVE-2026-20315 betrifft 'Improper Access Control'. Eine verhaltensbasierte Erkennung sollte auf ungewöhnliche oder nicht autorisierte Zugriffsversuche auf sensible Ressourcen oder Funktionen innerhalb von Cisco Secure Workload abzielen. Dies könnte die Überwachung von Zugriffslogs, Fehlermeldungen bei Zugriffsversuchen oder ungewöhnliche Aktivitäten von Benutzerkonten umfassen, d

Sentinel/Defender KQL

CiscoSecureWorkloadLogs
| where EventType == "AccessControl" and Result == "Failure" and Message contains "unauthorized access" or Message contains "permission denied"
| summarize count() by SourceIP, UserName, TargetResource, Action
| where count_ > 5 // Adjust threshold as needed for your environment

Splunk SPL

index=cisco_secure_workload sourcetype=access_logs ("unauthorized access" OR "permission denied")
| stats count by src_ip, user, resource, action
| where count > 5

Sigma

title: Cisco Secure Workload - Improper Access Control Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential attempts to exploit improper access control vulnerabilities in Cisco Secure Workload.
author: SecBoard
date: 2026/08/19
logsource:
  product: cisco_secure_workload
  service: access_logs
detection:
  selection:
    message|contains:
      - 'unauthorized access'
      - 'permission denied'
  condition: selection
level: high

Elastic ES|QL

FROM cisco_secure_workload_logs
| WHERE event.type == "access" AND event.outcome == "failure" AND (message LIKE "%unauthorized access%" OR message LIKE "%permission denied%")
| STATS count() BY source.ip, user.name, destination.resource, action
| WHERE count > 5

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen