Cisco has released security updates addressing nine vulnerabilities across its Crosswork platforms and Secure Workload Software, discovered as part of an ongoing internal security review. Five of the nine vulnerabilities carry a maximum CVSS score of 10.0, indicating critical severity. Four of the flaws affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning regardless of device configuration. The patches are part of a continued comprehensive internal audit of Cisco products. The vulnerabilities pose significant risk due to their critical scoring and broad impact across multiple Crosswork platform components. No specific CVE identifiers or exploitation details are provided in the article excerpt. Organizations using affected Cisco Crosswork and Secure Workload products are urged to apply the patches immediately. The breadth of affected products and the maximum CVSS scores highlight the severity of this security update round.
Cisco has released security patches for nine vulnerabilities across Crosswork platforms and Secure Workload Software, discovered during an ongoing internal security review. Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning (versions 7.2.1 and earlier): CVE-2026-20030 (SQL injection, CVSS 10.0), CVE-2026-20357 (missing authentication for critical function, CVSS 10.0), CVE-2026-20358 (external control of file system, CVSS 10.0), and CVE-2026-20359 (insufficiently protected credentials, CVSS 9.9). Five vulnerabilities affect Cisco Secure Workload (SaaS and on-premises): CVE-2026-20231 (command/OS/argument injection, CVSS 9.9), CVE-2026-20315 (improper access control including authorization bypass, CVSS 10.0), CVE-2026-20317 (improper authentication including missing auth and bypass, CVSS 10.0), CVE-2026-20318 (improper input validation including path traversal, CVSS 9.6), and CVE-2026-20319 (memory buffer violations including buffer overflows, CVSS 7.5). None of the vulnerabilities are known to be actively exploited at time of disclosure. This follows a prior round of patches for 12 bugs in Catalyst SD-WAN and IOS XE Software.
Apply the following patches immediately: For Cisco Crosswork (Data Gateway, Network Controller, Planning) running version 7.2.1 or earlier, upgrade to version 7.2.1-SP. For Cisco Secure Workload running version 3.10 or earlier, upgrade to version 3.10.9.1. For Cisco Secure Workload running version 4.0, upgrade to version 4.0.4.16. Refer to Cisco Security Advisories cisco-sa-hardening-crosswork-UzDTU9Vh and cisco-sa-hardening-csw1-shSvndWP for full details. While none of the nine vulnerabilities are known to be actively exploited, the severity (five rated CVSS 10.0) warrants urgent patching. Also ensure Cisco ASA and FTD software is patched for CVE-2026-20349 which is being actively exploited in the wild.
