Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco has published security updates for Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, including five with a CVSS score of 10.0. The issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2…
Intelligence analysis by Llama
Cisco has released security updates for Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, including five with a CVSS score of 10.0. The issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2.1-SP. Five vulnerabilities affecting Cisco Secure Workload have also been patched, including Software-as-a-Service …
Imagine you have a super powerful computer that can control many other computers. If someone finds a way to hack into this powerful computer, they can control all the other computers too. Cisco has found some ways that someone could hack into their powerful computer, so they are fixing those problems to keep their computer and the other computers safe.
Analysis
Vulnerabilities Found During Internal Testing
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration.
A brief description of each of the flaws is below -
CVE-2026-20030 (CVSS score: 10.0) - An SQL injection vulnerability CVE-2026-20357 (CVSS score: 10.0) - A missing authentication for critical function vulnerability CVE-2026-20358 (CVSS score: 10.0) - An external control of file system vulnerability CVE-2026-20359 (CVSS score: 9.9) - An insufficiently protected credentials vulnerability
The issues affect Cisco Crosswork Release version 7.2.1 and earlier, and have been addressed in version 7.2.1-SP. Cisco has also released fixes to remediate five vulnerabilities affecting Cisco Secure Workload, including Software-as-a-Service (SaaS) and on-premises deployments -
CVE-2026-20231 (CVSS score: 9.9) - A set of improper neutralization of special elements vulnerabilities spanning command, operating system, and argument injection CVE-2026-20315 (CVSS score: 10.0) - A set of improper access control vulnerabilities spanning authorization, authentication, privileges, and bypasses CVE-2026-20317 (CVSS score: 10.0) - A set of improper authentication vulnerabilities spanning missing authentication, authentication bypass, and reliance on untrusted inputs CVE-2026-20318 (CVSS score: 9.6) - A set of improper input validation vulnerabilities spanning input validation, path traversal, and external path control CVE-2026-20319 (CVSS score: 7.5) - A set of improper restriction of operations within the bounds of a memory buffer vulnerabilities spanning buffer overflows and out-of-bounds writes
The five vulnerabilities have been patched in the versions below -
Cisco Secure Workload Release version 3.10 and earlier - Fixed in 3.10.9.1 Cisco Secure Workload Release version 4.0 - Fixed in 4.0.4.16
"These vulnerabilities were found during internal testing and are not known to be actively exploited," the company said, urging customers to apply the necessary updates to avoid future exposure.
The development comes about two weeks after Cisco resolved 12 bugs impacting Catalyst SD-WAN and IOS XE Software following the internal security review. The review, the networking equipment major added, has "resulted in software hardening releases that address multiple internally discovered vulnerabilities."
The prevalence of Cisco gear within enterprise networks makes it an attractive target for bad actors, who have repeatedly exploited dozens of flaws impacting its products to gain unauthorized access and deploy malware.
Earlier this month, Cisco warned that a vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software (CVE-2026-20349, CVSS score: 8.6) has been exploited in the wild.
Key points
- Cisco has published security updates for Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, including five with a CVSS score of 10.0.
- The issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2.1-SP.
- Five vulnerabilities affecting Cisco Secure Workload have also been patched, including Software-as-a-Service (SaaS) and on-premises deployments.
- The prevalence of Cisco gear within enterprise networks makes it an attractive target for bad actors, who have repeatedly exploited dozens of flaws impacting its products to gain unauthorized access and deploy malware.
If Cisco's customers apply the necessary updates, they can avoid future exposure to these vulnerabilities. This will help keep their networks and data safe from potential attacks.
If Cisco's customers do not apply the necessary updates, they may be vulnerable to attacks that could compromise their networks and data. This could lead to significant financial losses and reputational damage.
