Cisco has patched 9 vulnerabilities across Crosswork — Data Gateway, Network Controller and Planning — and Secure Workload, in both SaaS and on-premises deployments.
5 of them score CVSS 10.0.
Five maximum-severity flaws in a single advisory cycle is not a normal week for any vendor.
The nine
| CVE | Score | Class | Product |
|---|---|---|---|
| CVE-2026-20030 | 10.0 | SQL injection | Crosswork |
| CVE-2026-20357 | 10.0 | Missing authentication for critical function | Crosswork |
| CVE-2026-20358 | 10.0 | External control of file system | Crosswork |
| CVE-2026-20315 | 10.0 | Access control bypass | Secure Workload |
| CVE-2026-20317 | 10.0 | Authentication bypass | Secure Workload |
| CVE-2026-20359 | 9.9 | Insufficiently protected credentials | Crosswork |
| CVE-2026-20231 | 9.9 | Command / OS / argument injection | Secure Workload |
| CVE-2026-20318 | 9.6 | Input validation, path traversal | Secure Workload |
| CVE-2026-20319 | 7.5 | Buffer overflow, out-of-bounds write | Secure Workload |
Read the class column rather than the numbers. Missing authentication for a critical function, access control bypass and authentication bypass are three separate ways of describing the same outcome — a caller who should have been stopped, and was not.
What these products are
This matters more than the CVSS.
Crosswork is network automation and orchestration: it holds credentials for network devices and pushes configuration to them. Secure Workload is microsegmentation — it decides which workloads may talk to which.
So an authentication bypass here does not get an attacker onto a server. It gets them to the thing that configures the servers, or the thing that decides what the firewall rules are. Compromising the management plane is strictly better than compromising anything it manages, which is the same reason the Clop web shell that decrypted the LDAP manager password out of a Windchill keystore mattered beyond the application it sat in.
Fixed in
| Product | Affected | Upgrade to |
|---|---|---|
| Crosswork | 7.2.1 and earlier | 7.2.1-SP |
| Secure Workload | 3.10 and earlier | 3.10.9.1 |
| Secure Workload | 4.0 | 4.0.4.16 |
Found internally, which cuts both ways
Cisco says the flaws came out of internal testing and are not known to be actively exploited.
That is genuinely good. A vendor auditing its own products and shipping nine fixes, five at maximum severity, before anyone was attacked, is the process working. It is also the second such batch in a fortnight, following 12 fixes for Catalyst SD-WAN and IOS XE.
The uncomfortable reading is the obvious one: if a focused internal review keeps producing maximum-severity authentication bypasses, they were there for a while and something other than an internal review could have found them first. Twenty-one serious flaws in two weeks is a statement about what was already shipped, not only about the quality of the review.
What to do
- Patch, and prioritise Secure Workload's two bypasses. A segmentation product that can be bypassed is worse than no segmentation product, because you planned around it.
- Check whether these interfaces are reachable from anywhere they should not be. Management planes end up on flat networks more often than anyone admits.
- Rotate the device credentials Crosswork holds. Insufficiently protected credentials at 9.9 is in this batch, and that is what it protects.
- Review recent configuration pushes. If the orchestrator could be reached without authenticating, the record of what it changed is what you check.
- Do not skip 7.5. It is the lowest number here and it is still a memory-safety flaw in the same product.
What is not established
- Whether any of these were found externally first. Cisco reports internal discovery.
- Whether exploitation has begun. None known at the time of writing.
- How many deployments are exposed. No figures published.
- How long the flaws were present. Not stated.
