Cisco Patches Critical Crosswork, Secure Workload Flaws With CVSS 10/10 Scores

Cisco on Wednesday disclosed patches for 15 vulnerabilities spanning multiple product lines, including several critical-severity flaws in Crosswork and Secure Workload that could enable remote code execution, authentication bypass, and arbitrary file manipulation. Crosswork version 7.2.1-SP addresses four critical CVEs, three of which—CVE-2026-20030, CVE-2026-20357, and CVE-2026-20358—carry a maximum CVSS score of 10/10. A fourth flaw, CVE-2026-20359, was rated 9.9/10. The issues stem from SQL injection, missing authentication mechanisms, external control of file system paths, and insufficient credential protection. Given the authentication weaknesses involved, administrators should also verify that no default or weak credentials are in use across affected deployments with a password checker.

Secure Workload versions 4.0.4.16 and 3.10.9.1 remediate five additional CVEs, four of which are rated critical. CVE-2026-20315 and CVE-2026-20317 cover improper access control and authentication bugs that could allow attackers to bypass security controls entirely, while CVE-2026-20231 addresses code and OS command injection flaws. CVE-2026-20318 resolves input validation and path traversal issues, and CVE-2026-20319 addresses buffer overflow and out-of-bounds write conditions. Because these defects target workload security platforms, organizations running multi-tenant or hybrid cloud environments should prioritize patching and review exposure surfaces immediately.

Cisco also fixed a high-severity XXE vulnerability—CVE-2026-20320—in the Open Client Interface (OCI) XML parser of BroadWorks, where external entity resolution was enabled by default. Exploitation requires no authentication and could allow attackers to read sensitive configuration files under BroadWorks user privileges. The flaw was resolved in version RI.2026.07 of the BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. Additional medium-severity patches were issued for Unified Intelligence Center, RoomOS, Industrial Ethernet 1000 series switches, and Packaged Contact Center Enterprise. Cisco stated it is not aware of active in-the-wild exploitation of any of the flaws. Network defenders should confirm TLS configurations on impacted appliances are properly enforced using an SSL/TLS checker to reduce the attack surface alongside the vendor patches.