Cisco has rolled out urgent security fixes for nine critical vulnerabilities found across its Crosswork platforms and Secure Workload software. These flaws surfaced during an internal security review and, while no signs of active exploitation have emerged, Cisco is urging all users to upgrade immediately. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
Crosswork: Four CVSS-10 Flaws That Can Lead to Total Compromise
The Crosswork suite—including Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning—is affected by four highly critical bugs. All are present in version 7.2.1 and earlier, now addressed in version 7.2.1-SP. The most severe include:
- CVE-2026-20030 – SQL injection allowing arbitrary database commands. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20357 – Missing authentication for critical functions. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20358 – External control over the file system. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20359 – Credentials inadequately protected; very high risk. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
Secure Workload: Five More High-Risk Flaws Patched
Secure Workload—both as SaaS and on-premises—contains five additional vulnerabilities, four with CVSS scores from 9.6 to 10.0, and one somewhat lower-severity buffer overflow issue (CVE-2026-20319, scored 7.5). Users of versions 3.10 (and earlier) and 4.0 should upgrade to the patched releases: 3.10.9.1 or 4.0.4.16. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
Notable Secure Workload flaws include:
- CVE-2026-20231 – Multiple injection flaws (command, OS, argument) enabling attackers to insert malicious input. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20315 – Access control issues spanning authentication, authorization, privilege escalation; vulnerability bypass potential. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20317 – Authentication bypasses, missing authentication requirements, and unsafe reliance on external input. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20318 – Unsafe input validation including path traversal and external path control attacks. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
- CVE-2026-20319 – Buffer overflows and out-of-bounds write vulnerabilities. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
Why It Matters
These vulnerabilities hit deep: missing authentication, insecure handling of input, and direct file system control can give attackers a wide range of exploit vectors. Combined with Cisco’s reach across enterprise networks, a successful breach could mean system compromise, data exfiltration, or persistent access. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
Although Cisco reports no signs that these flaws are actively being used in attacks, the history of critical Cisco bugs being leveraged in the wild suggests a narrow window before they might be exploited. The patches follow a prior batch released roughly two weeks earlier fixing 12 vulnerabilities in Catalyst SD-WAN and IOS XE. ([thehackernews.com](https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html))
Action Steps: Upgrade Crosswork users to version 7.2.1-SP. For Secure Workload, move to releases 3.10.9.1 or 4.0.4.16. If you’ve customized configurations, verify that critical functions are properly gated and credentials are stored securely. Conduct internal audits and threat modeling to uncover similar weaknesses.
This batch of patches shows how even industry giants like Cisco aren’t immune to high-severity vulnerabilities. Security teams should treat this as a wake-up call: proactive discovery and quick patch deployment are essential. With attackers actively looking for unpatched targets, delaying updates could turn oversight into breach.
