Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco patched nine critical vulnerabilities across its Crosswork platforms and Secure Workload products, five of which scored a maximum CVSS 10.0 Four Crosswork flaws include SQL injection, missing authentication, external file system control, and insufficiently protected credentials, all affecting versions 7.2.1 and earlier Five Secure Workload vulnerabilities span command injection, improper access control, authentication bypass, input validation flaws, and buffer overflow issues All issues we
Analysis
TL;DR
- Cisco patched nine critical vulnerabilities across its Crosswork platforms and Secure Workload products, five of which scored a maximum CVSS 10.0
- Four Crosswork flaws include SQL injection, missing authentication, external file system control, and insufficiently protected credentials, all affecting versions 7.2.1 and earlier
- Five Secure Workload vulnerabilities span command injection, improper access control, authentication bypass, input validation flaws, and buffer overflow issues
- All issues were discovered during internal testing and are not known to be actively exploited, though Cisco urges immediate patching
- This follows a broader internal security review that has already addressed 12 bugs in Catalyst SD-WAN and IOS XE, plus a separately exploited firewall vulnerability (CVE-2026-20349)
Why It Matters
Cisco's networking and security infrastructure is deeply embedded in enterprise environments worldwide, making mass exploitation of these flaws a high-impact scenario for threat actors. The concentration of CVSS 10.0 vulnerabilities—particularly authentication bypass and SQL injection—means a single compromised instance could lead to full system takeover with no prior credentials. This ongoing internal security review signals a proactive shift in Cisco's vulnerability management posture, which has direct implications for how enterprises prioritize patching cycles and assess their exposure to widely deployed Cisco platforms.
Technical Details
- Crosswork Vulnerabilities (4 flaws): CVE-2026-20030 (SQL injection, CVSS 10.0), CVE-2026-20357 (missing authentication for critical functions, CVSS 10.0), CVE-2026-20358 (external control of file system, CVSS 10.0), and CVE-2026-20359 (insufficiently protected credentials, CVSS 9.9). All affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration. Patched in Crosswork Release 7.2.1-SP.
- Secure Workload Vulnerabilities (5 flaws): CVE-2026-20231 (command/OS/argument injection, CVSS 9.9), CVE-2026-20315 (improper access control spanning authorization and privilege bypass, CVSS 10.0), CVE-2026-20317 (authentication bypass and reliance on untrusted inputs, CVSS 10.0), CVE-2026-20318 (input validation, path traversal, external path control, CVSS 9.6), and CVE-2026-20319 (buffer overflow and out-of-bounds writes, CVSS 7.5). Fixed in Secure Workload 3.10.9.1 and 4.0.4.16.
- Patch versions: Crosswork 7.2.1-SP; Secure Workload 3.10.9.1 (for releases 3.10 and earlier) and 4.0.4.16 (for release 4.0).
- Context: These patches are part of a comprehensive internal security review that previously addressed 12 bugs in Catalyst SD-WAN and IOS XE Software. A separate vulnerability in Secure Firewall ASA/FTD (CVE-2026-20349, CVSS 8.6) has already been exploited in the wild.
Industry Insight
- Enterprises running Cisco Crosswork or Secure Workload should treat these patches as critical priority, especially given the authentication bypass and SQL injection flaws that require no prior access for exploitation.
- The pattern of internally discovered vulnerabilities across multiple product lines suggests Cisco's security review program is effective at surface-level remediation, but organizations should audit their own configurations and network segmentation to limit blast radius while patches are deployed.
- With Cisco gear being a repeatedly targeted vector by threat actors, the coexistence of unexploited critical flaws alongside an actively exploited firewall vulnerability underscores the importance of maintaining strict update cadences and monitoring for emerging threat intelligence related to Cisco product lines.
Disclaimer: The above content is generated by AI and is for reference only.