Cisco has published another round of security updates for its Crosswork network automation and Secure Workload cloud-security platforms, patching nine vulnerabilities — five of them rated a maximum CVSS 10.0 — that were surfaced during a continued comprehensive internal security review. Cisco's Product Security Incident Response Team (PSIRT) said none of the bugs is known to be actively exploited, but the company is urging customers to upgrade quickly given the impact.
Four Critical Crosswork Flaws
Four of the flaws affect Cisco Crosswork Data Gateway, Crosswork Network Controller and Crosswork Planning regardless of device configuration, and are addressed in Crosswork release 7.2.1-SP for anyone running 7.2.1 or earlier. The list is worst-case territory for network automation platforms that sit on top of service-provider and large enterprise backbones:
- CVE-2026-20030 (CVSS 10.0) — SQL injection
- CVE-2026-20357 (CVSS 10.0) — missing authentication for critical function
- CVE-2026-20358 (CVSS 10.0) — external control of file system
- CVE-2026-20359 (CVSS 9.9) — insufficiently protected credentials
Five More In Secure Workload
Cisco also patched five vulnerabilities in Cisco Secure Workload spanning both SaaS and on-premises deployments. CVE-2026-20231 (9.9) covers a set of improper-neutralization issues that permit command, OS and argument injection; CVE-2026-20315 (10.0) is a cluster of improper access control weaknesses affecting authorization, authentication and privilege enforcement; CVE-2026-20317 (10.0) rolls up missing authentication, authentication bypass and reliance-on-untrusted-inputs bugs; CVE-2026-20318 (9.6) fixes input validation, path traversal and external path control problems; and CVE-2026-20319 (7.5) closes buffer overflow and out-of-bounds write issues. Secure Workload releases up to 3.10 are fixed in 3.10.9.1, and the 4.0 branch is fixed in 4.0.4.16.
Part Of A Broader Hardening Push
The updates arrive about two weeks after Cisco resolved 12 bugs in Catalyst SD-WAN and IOS XE, another product family swept during the same internal review that Cisco said has "resulted in software hardening releases that address multiple internally discovered vulnerabilities." The prevalence of Cisco gear inside enterprise networks has made it a favorite target for attackers, who continue to weaponize product flaws for initial access and malware deployment.
Context: A Loud Month For Enterprise Bugs
Cisco's fixes land in the middle of a very noisy month for enterprise security teams. Microsoft patched 421 CVEs in August's Patch Tuesday, including an Entra ID max-severity flaw, and Cl0p has begun leaking claimed data from dozens of enterprises via a critical PTC Windchill vulnerability. Cisco customers running affected Crosswork or Secure Workload versions should treat 7.2.1-SP, 3.10.9.1 and 4.0.4.16 as top-priority upgrades.
Reporting based on coverage from The Hacker News, Cisco PSIRT, ISSSource and GuardianMSSP.