Cisco Crosswork Security Hardening Release: August 2026 Summary

• As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

  These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.

  Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-crosswork-UzDTU9Vh

Affected Products

• These vulnerabilities affect the following Cisco Crosswork platforms, regardless of device configuration:

  • Crosswork Data Gateway
  • Crosswork Network Controller
  • Crosswork Planning
  • Crosswork Workflow Manager

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities.

Details

• The following table outlines the vulnerability classes that are addressed in this hardening release. The CVSS score that is assigned to each CVE ID represents the maximum potential severity of the single most impactful underlying vulnerability within that specific CWE category.

• CVE ID: CVE-2026-20030

• Highest CVSS Score: 10.0
• Vulnerability Class (Highest-Level CWE): CWE-89
• Description: Improper neutralization of special elements used in a SQL command
• CVE ID: CVE-2026-20357
• Highest CVSS Score: 10.0
• Vulnerability Class (Highest-Level CWE): CWE-306
• Description: Missing authentication for critical function
• CVE ID: CVE-2026-20358
• Highest CVSS Score: 10.0
• Vulnerability Class (Highest-Level CWE): CWE-73
• Description: External control of file system
• CVE ID: CVE-2026-20359
• Highest CVSS Score: 9.9
• Vulnerability Class (Highest-Level CWE): CWE-522
• Description: Insufficiently protected credentials

Workarounds

• There are no workarounds that address these vulnerabilities.

Fixed Software

• To fully remediate these vulnerabilities and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Fixed Releases

  In the following table, the left column lists Cisco Crosswork products. The center column indicates which specific releases are affected by the vulnerabilities that are described in this advisory. The right column indicates whether a release is affected by these vulnerabilities and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.

The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

Source

• These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.

Cisco Security Vulnerability Policy

Related to This Advisory

URL

Revision History

• Version: 2.0

• Description: Added Cisco Crosswork Workflow Manager as an affected product.
• Section: Vulnerable Products and Fixed Releases
• Status: Final
• Date: 2026-AUG-21
• Version: 1.0
• Description: Initial public release.
• Section: -
• Status: Final
• Date: 2026-AUG-19