Cisco has released a new set of security updates addressing nine vulnerabilities affecting its Crosswork platforms and Secure Workload Software as part of its ongoing internal security review process. The security issues include multiple critical flaws, with five vulnerabilities receiving a maximum CVSS severity score of 10.0. Cisco said the vulnerabilities were identified through internal testing and are not currently known to be under active exploitation. Four of the vulnerabilities impact Cisco Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning products regardless of device configuration. The identified flaws include CVE-2026-20030, a SQL injection vulnerability with a CVSS score of 10.0; CVE-2026-20357, a missing authentication for critical function vulnerability with a CVSS score of 10.0; CVE-2026-20358, an external control of file system vulnerability with a CVSS score of 10.0; and CVE-2026-20359, an insufficiently protected credentials vulnerability rated at CVSS 9.9. These vulnerabilities affect Cisco Crosswork Release version 7.2.1 and earlier releases and have been addressed in version 7.2.1-SP.
Cisco has also issued fixes for five vulnerabilities affecting Cisco Secure Workload Software, covering both Software as a Service (SaaS) and on-premises deployments. The affected issues include CVE-2026-20231, which involves improper neutralization of special elements across command, operating system, and argument injection scenarios, with a CVSS score of 9.9. Another critical issue, CVE-2026-20315, relates to improper access control vulnerabilities involving authorization, authentication, privilege handling, and bypass scenarios, receiving a CVSS score of 10.0. CVE-2026-20317 addresses improper authentication vulnerabilities involving missing authentication, authentication bypass, and reliance on untrusted inputs, also rated CVSS 10.0. The remaining flaws include CVE-2026-20318, involving improper input validation, path traversal, and external path control vulnerabilities with a CVSS score of 9.6, and CVE-2026-20319, related to improper restriction of operations within memory buffer boundaries, including buffer overflow and out of bounds write issues, with a CVSS score of 7.5.
The five Cisco Secure Workload vulnerabilities have been fixed in Cisco Secure Workload Release version 3.10 and earlier through version 3.10.9.1, while Cisco Secure Workload Release version 4.0 has been updated to version 4.0.4.16. Cisco advised customers to apply the available updates to reduce potential exposure and strengthen security protection across affected deployments. The company said these vulnerabilities were discovered during internal testing and have not been linked to known exploitation activity. The latest updates follow Cisco previous security releases addressing 12 vulnerabilities affecting Catalyst SD WAN and IOS XE Software after the internal security review process. Cisco said the review has resulted in software hardening releases designed to address multiple internally discovered vulnerabilities across its products. Due to the widespread use of Cisco networking equipment in enterprise environments, vulnerabilities affecting its products continue to receive attention from security researchers and attackers attempting to gain unauthorized access.
Earlier this month, Cisco also disclosed that a vulnerability affecting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software, tracked as CVE-2026-20349 with a CVSS score of 8.6, had been exploited in the wild. The company continues to recommend that organizations using affected Cisco products install the latest security updates and follow available mitigation guidance to maintain secure network environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
