Six Maximum-Severity Flaws Found in Cisco Products

Cisco patched nine critical flaws, including six rated CVSS 10.0, found during internal testing. None are known to be exploited.

Cisco released another batch of security fixes for its Crosswork platforms and Secure Workload software, part of what it’s calling an ongoing internal security review, and the CVSS scores in this round are unusually severe.

“As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.” reads the advisory. “These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class – Common Weakness Enumeration (CWE) – and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.”

Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, all impacting these products regardless of how they’re configured:

• CVE-2026-20030 (CVSS score: 10.0) – an SQL injection vulnerability that lets an attacker manipulate database queries directly.
• CVE-2026-20357 (CVSS score: 10.0) – a missing authentication for critical function vulnerability, meaning a sensitive operation can be triggered without ever proving who you are.
• CVE-2026-20358 (CVSS score: 10.0) – an external control of file system vulnerability, letting an outside actor influence which files the system reads or writes.
• CVE-2026-20359 (CVSS score: 9.9) – an insufficiently protected credentials vulnerability, where stored login material isn’t locked down the way it should be.

Seeing three CVSS 10.0 vulnerabilities in a single Cisco advisory is unusual. The four flaws affect Crosswork 7.2.1 and earlier, and Cisco fixed them in version 7.2.1-SP.

Five more vulnerabilities got patched in Cisco Secure Workload, spanning both its cloud SaaS and on-premises deployments:

• CVE-2026-20231 (CVSS score: 9.9) – a set of improper neutralization of special elements vulnerabilities covering command, operating system, and argument injection, essentially several different ways to smuggle unintended commands into the system.
• CVE-2026-20315 (CVSS score: 10.0) – a set of improper access control vulnerabilities spanning authorization, authentication, privileges, and bypasses, a broad category that generally means the system doesn’t reliably enforce who’s allowed to do what.
• CVE-2026-20317 (CVSS score: 10.0) – a set of improper authentication vulnerabilities covering missing authentication, authentication bypass, and reliance on untrusted inputs, another maximum-severity cluster centered on identity verification failing outright.
• CVE-2026-20318 (CVSS score: 9.6) – a set of improper input validation vulnerabilities spanning input validation, path traversal, and external path control, the kind of flaw that lets crafted input reach files or directories it was never meant to touch.
• CVE-2026-20319 (CVSS score: 7.5) – a set of improper restriction of operations within the bounds of a memory buffer vulnerabilities spanning buffer overflows and out-of-bounds writes, lower severity than the rest but still a genuine memory-safety problem.

The networking giant addressed five vulnerabilities in Secure Workload Release 3.10.9.1 for the 3.10 branch and earlier, and 4.0.4.16 for the 4.0 branch.

The company found these vulnerabilities during internal testing; it is not aware of attacks in the wild exploiting this issue.

“The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.” conctinues the advisory. “Cisco says it found the vulnerabilities through internal security testing that also used advanced AI models.”

Nobody’s reported active attacks against any of these nine flaws yet, and Cisco’s own review process caught them before an outside researcher or attacker did.

If your organization runs Crosswork or Secure Workload in any configuration, this isn’t a patch to schedule for next month’s maintenance window. Perfect CVSS scores tend to attract attention fast once a vulnerability’s technical details start circulating, and Cisco’s internal discovery only buys you a head start if you actually use it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco)