Cisco Patches 9 Critical Flaws in Crosswork and Secure Workload, 5 Rated CVSS 10.0

Cisco has released a new round of security updates addressing nine vulnerabilities across its Crosswork platforms and Secure Workload software, five of which carry a maximum CVSS score of 10.0. The flaws were uncovered during an ongoing internal security review and affect enterprise-grade network management and workload security products widely deployed in large-scale environments. Four of the vulnerabilities impact Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning irrespective of device configuration, while the remaining five target Cisco Secure Workload in both Software-as-a-Service (SaaS) and on-premises deployments.

The Crosswork-related bugs include CVE-2026-20030, an SQL injection flaw scored 10.0; CVE-2026-20357, a missing authentication for critical function vulnerability also scored 10.0; CVE-2026-20358, an external control of file system vulnerability rated 10.0; and CVE-2026-20359, an insufficiently protected credentials issue scored 9.9. These affect Cisco Crosswork Release 7.2.1 and earlier and have been remediated in version 7.2.1-SP. Given the severity of authentication bypasses like CVE-2026-20357, administrators should verify that no unauthorized access has occurred by reviewing credential exposure using an email breach checker and confirming strong, unique credentials via a password checker.

For Secure Workload, the fixed flaws include CVE-2026-20231 (CVSS 9.9) covering improper neutralization of special elements leading to command, operating system, and argument injection; CVE-2026-20315 (CVSS 10.0) involving improper access control across authorization, authentication, privileges, and bypasses; CVE-2026-20317 (CVSS 10.0) encompassing improper authentication issues including missing authentication, authentication bypass, and reliance on untrusted inputs; CVE-2026-20318 (CVSS 9.6) addressing improper input validation, path traversal, and external path control; and CVE-2026-20319 (CVSS 7.5) covering buffer overflows and out-of-bounds writes. These have been patched in Release 3.10.9.1 for version 3.10 and earlier, and in 4.0.4.16 for version 4.0.

Cisco emphasized that none of these vulnerabilities are known to be actively exploited in the wild, though the prevalence of Cisco gear in enterprise networks makes the vendor a perennial target for threat actors who have repeatedly chained its flaws for initial access and malware deployment. The company urged customers to apply the updates without delay. This advisory follows roughly two weeks after Cisco resolved 12 separate bugs in Catalyst SD-WAN and IOS XE Software under the same internal review initiative. Organizations seeking to assess their broader attack surface can run a privacy checkup to identify exposed services and ensure hardening measures are aligned with current best practices.