Cisco Fixes Nine Vulnerabilities in Crosswork and Secure Workload, Five Rated 10.0

Cisco has released another package of security updates for the Crosswork platforms and for the Secure Workload software. According to the vendor, the vulnerabilities were discovered during an ongoing internal security review that results in the release of “hardening” builds addressing issues found within the company.

Crosswork

Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller and Crosswork Planning — regardless of the device configuration. Three of them are rated at the maximum:

• CVE-2026-20030 (CVSS 10.0) — SQL injection;
• CVE-2026-20357 (CVSS 10.0) — missing authentication for a critical function;
• CVE-2026-20358 (CVSS 10.0) — external control of the file system;
• CVE-2026-20359 (CVSS 9.9) — insufficiently protected credentials.

The issues affect Crosswork version 7.2.1 and earlier; they are fixed in 7.2.1-SP.

Secure Workload

Another five vulnerabilities concern Secure Workload — both the cloud (SaaS) and the on-premises installation. Once again, scores of 10.0 appear among them:

• CVE-2026-20231 (CVSS 9.9) — a set of command, OS and argument injections;
• CVE-2026-20315 (CVSS 10.0) — improper access control (authorization, authentication, privileges, bypasses);
• CVE-2026-20317 (CVSS 10.0) — improper authentication, including its absence and bypass;
• CVE-2026-20318 (CVSS 9.6) — insufficient input validation, directory traversal, external control of paths;
• CVE-2026-20319 (CVSS 7.5) — buffer overflows and out-of-bounds writes.

The patches are included in Secure Workload 3.10.9.1 (for the 3.10 branch and earlier) and 4.0.4.16 (for the 4.0 branch).

Cisco stresses that all of the holes were found during internal testing and that there are no signs of their exploitation in the wild. Nevertheless, the company urges customers to install the updates so as not to expose themselves to risk in the future.

The release came roughly two weeks after 12 bugs were fixed in Catalyst SD-WAN and IOS XE — also as a result of an internal audit. Cisco equipment is widespread in corporate networks, which makes it an attractive target: attackers have repeatedly exploited dozens of its vulnerabilities for unauthorized access and to deploy malware. Earlier this month, Cisco already warned about an actively exploited flaw in Secure Firewall ASA and FTD (CVE-2026-20349, CVSS 8.6).

Source: The Hacker News