Security Intelligence
Loading table of contents...
At a glance:
-
Cisco released updates on August 19, 2026, addressing nine vulnerabilities in Cisco Crosswork and Cisco Secure Workload, including five rated Critical with Common Vulnerability Scoring System (CVSS) scores of 10.0.
-
The vulnerabilities could allow authentication bypass, command injection, credential compromise, file manipulation, and other unauthorized actions on affected systems.
-
Cisco reported the vulnerabilities were identified during internal security testing and stated it was not aware of exploitation in the wild.
Threat summary
On August 19, 2026, Cisco published security advisories for multiple vulnerabilities affecting Cisco Crosswork and Cisco Secure Workload.
The flaws were disclosed as part of a security hardening initiative and were grouped by vulnerability type rather than assigning a separate CVE identifier for each weakness.
Cisco Crosswork is a network automation and operations platform used by service providers and large enterprises to manage network infrastructure. Cisco Secure Workload, formerly known as Tetration, is used to monitor application communications, enforce segmentation policies, and provide workload visibility across cloud and data center environments.
Both platforms typically operate with privileged access to infrastructure and security management functions.
The Crosswork vulnerabilities include:
-
CVE-2026-20030: SQL injection (CVSS 10.0)
-
CVE-2026-20357: Missing authentication (CVSS 10.0)
-
CVE-2026-20358: External control of the file system (CVSS 10.0)
-
CVE-2026-20359: Insufficiently protected credentials (CVSS 10.0)
Cisco states successful exploitation could allow authentication bypass, path traversal, credential exposure, file overwrite or deletion, and in some cases remote code execution.
The Secure Workload vulnerabilities include:
-
CVE-2026-20231: Command and operating system injection
-
CVE-2026-20315: Improper access control
-
CVE-2026-20317: Improper authentication
-
CVE-2026-20318: Path traversal and input validation weaknesses
-
CVE-2026-20319: Memory corruption vulnerabilities
Four of the five vulnerabilities received Critical severity ratings. Cisco states successful exploitation could allow unauthorized access to the platform, command execution, access to sensitive files, and manipulation of security controls.
Cisco states the vulnerabilities were discovered during internal testing. Public proof-of-concept exploits have not been identified, and Cisco reported no evidence of active exploitation when the advisories were released.
Analysis
Both platforms often occupy trusted positions within enterprise environments. Crosswork may have visibility into network topology, devices, and operational workflows, while Secure Workload can have access to application communications, segmentation policies, and workload activity.
A compromise of either platform could provide an adversary with access to information and administrative functions that extend beyond the server hosting the software.
Internet-facing Cisco Crosswork deployments represent the highest risk because they expose a platform used to manage and automate critical network infrastructure. Secure Workload deployments protecting production applications and cloud environments are also high-value targets due to the sensitive information and security controls they manage. Internal-only deployments face lower immediate exposure, but their privileged position within the environment make them meaningful targets following an initial compromise.
The authentication, access control, and command injection vulnerabilities present the most direct path to platform compromise. The file system and path traversal vulnerabilities could expose sensitive files or permit unauthorized modification of data, while the credential protection weakness could expose accounts trusted by the platform.
The practical impact depends on how the software is deployed and what privileges are available to the affected services.
Mitigations
Identify all Cisco Crosswork and Secure Workload deployments and verify the software versions in use. Give priority to internet-facing systems and deployments supporting production infrastructure.
Cisco has addressed the vulnerabilities in:
-
Crosswork version 7.2.1-SP
-
Secure Workload version 3.10.9.1
-
Secure Workload version 4.0.4.16
Cisco reports that no Crosswork workarounds are available, making software updates the most effective mitigation.
Until patching is complete, limit access to management interfaces, review privileged accounts, and monitor for unusual authentication activity, administrative actions, configuration changes, and policy modifications.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
