Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Cisco published patches for four Crosswork flaws affecting Data Gateway, Network Controller, and Planning — three scoring CVSS 10.0 and one at 9.9 — impacting Release 7.2.1 and earlier, fixed in version 7.2.1-SP.
- Cisco Secure Workload received fixes for five additional vulnerabilities spanning SaaS and on-premises deployments, including two rated CVSS 10.0, one at 9.9, one at 9.6, and one at 7.5, patched in releases 3.10.9.1 and 4.0.4.16.
- The Crosswork SQL injection flaw CVE-2026-20030 and missing-authentication vulnerability CVE-2026-20357 both scored CVSS 10.0 and affect devices regardless of configuration.
- CVE-2026-20315 in Secure Workload bundles improper access control issues spanning authorization, authentication, privileges, and bypasses — earning a CVSS 10.0 score.
- Cisco stated all nine vulnerabilities were discovered during internal testing and are not known to be actively exploited, urging customers to apply updates.
- The patches arrive roughly two weeks after Cisco resolved 12 bugs in Catalyst SD-WAN and IOS XE Software, and shortly after the company confirmed CVE-2026-20349 (CVSS 8.6) in Secure Firewall ASA and FTD Software was exploited in the wild.
Why it matters: Enterprise networks running Cisco Crosswork Release 7.2.1 or earlier and Secure Workload versions up to 4.0 face exposure to maximum-severity (CVSS 10.0) flaws including SQL injection and missing authentication — both remotely triggerable and configuration-independent. The contrast between this internally-discovered batch (not actively exploited) and a separate in-the-wild Cisco firewall exploit earlier this month highlights why the company's ongoing review is producing a steady stream of emergency patches.
Ask SkimNews
