Cisco Crosswork Secure Workload Vulnerabilities
Cisco just dropped another round of security updates. This time, it's for Crosswork platforms and Secure Workload Software. The patches are part of a larger internal security review that's been going on for a while.
Four of the vulnerabilities hit Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning. And here's the kicker: they affect these products no matter how you've configured them.
Five more vulnerabilities are in Cisco Secure Workload, covering both SaaS and on-premises deployments.
Let me break down what's going on and what you need to do.
Quick Summary of What's Happening
- Four Crosswork flaws with CVSS scores up to 10.0
- Five Secure Workload flaws with CVSS scores up to 10.0
- All found during internal testing (not being exploited yet)
- Crosswork fixed in version 7.2.1-SP
- Secure Workload fixed in 3.10.9.1 and 4.0.4.16
- Part of Cisco's ongoing internal security review
The Crosswork Vulnerabilities
Here are the four critical flaws affecting Crosswork platforms:
CVE-2026-20030 (CVSS: 10.0)
An SQL injection vulnerability. Attackers could execute arbitrary SQL commands on your systems.
CVE-2026-20357 (CVSS: 10.0)
Missing authentication for critical functions. Attackers could access sensitive functions without any credentials.
CVE-2026-20358 (CVSS: 10.0)
External control of file system. The attackers may have the capability to control the operations of the file system.
CVE-2026-20359 (CVSS: 9.9)
Insufficiently protected credentials. Sensitive credentials could be exposed.
Affected Versions:
Cisco Crosswork Release version 7.2.1 and earlier.
The Fix:
Cisco Crosswork 7.2.1-SP.
The Secure Workload Vulnerabilities
Here are the five flaws affecting Cisco Secure Workload:
CVE-2026-20231 (CVSS: 9.9)
Command, operating system, and argument injection vulnerabilities.
CVE-2026-20315 (CVSS: 10.0)
Improper access control. Covers authorization, authentication, privileges, and bypasses.
CVE-2026-20317 (CVSS: 10.0)
Improper authentication. Covers missing authentication, authentication bypass, and reliance on untrusted inputs.
CVE-2026-20318 (CVSS: 9.6)
Improper input validation. Covers input validation, path traversal, and external path control.
CVE-2026-20319 (CVSS: 7.5)
Buffer overflows and out-of-bounds writes.
Affected Versions:
- Cisco Secure Workload Release version 3.10 and earlier
- Cisco Secure Workload Release version 4.0
The Fix:
- Cisco Secure Workload 3.10.9.1
- Cisco Secure Workload 4.0.4.16
Why This Matters
Cisco found these Cisco Crosswork Secure Workload vulnerabilities during internal testing. They're not being actively exploited yet. But that doesn't mean you should wait.
Cisco's security review has "resulted in software hardening releases that address multiple internally discovered vulnerabilities." This is part of a larger effort. About two weeks ago, Cisco fixed 12 bugs in Catalyst SD-WAN and IOS XE Software.
Why Cisco Is a Target:
Cisco gear is everywhere in enterprise networks. That makes it an attractive target for attackers. They've repeatedly exploited dozens of Cisco flaws to gain unauthorized access and deploy malware.
Earlier this month, Cisco warned that a vulnerability in Secure Firewall ASA and FTD Software (CVE-2026-20349, CVSS: 8.6) is already being exploited in the wild.
What You Should Do
For Crosswork Users:
- Update to Crosswork 7.2.1-SP immediately. Versions 7.2.1 and earlier are affected.
For Secure Workload Users:
- Update to 3.10.9.1 if you're on 3.10
- Update to 4.0.4.16 if you're on 4.0
General Recommendations:
- Check your environment for affected Cisco products
- Apply patches as soon as possible
- Monitor for suspicious activity
- Stay informed about future Cisco security advisories
The Bottom Line
Cisco has patched critical vulnerabilities in Crosswork platforms and Secure Workload Software. Some of these flaws have CVSS scores of 10.0, the highest possible.
What You Need to Know:
- Four Crosswork flaws with CVSS up to 10.0
- Five Secure Workload flaws with CVSS up to 10.0
- Fixed in Crosswork 7.2.1-SP
- Fixed in Secure Workload 3.10.9.1 and 4.0.4.16
- Found during internal testing
- Not actively exploited (yet)
What You Need to Do:
- Update to Crosswork 7.2.1-SP
- Update to Secure Workload 3.10.9.1 or 4.0.4.16
- Check your environment for affected products
- Monitor for suspicious activity
- Don't wait. Patch now.
FAQ Section
What are the Cisco Crosswork Secure Workload vulnerabilities?
They are critical security flaws in Cisco Crosswork platforms and Secure Workload Software. The vulnerabilities include SQL injection, missing authentication, improper access control, and buffer overflows.
Which versions are affected?
Crosswork 7.2.1 and earlier are affected. Secure Workload 3.10 and earlier, and 4.0, are affected.
What is the fixed version?
Crosswork is fixed in 7.2.1-SP. Secure Workload is fixed in 3.10.9.1 and 4.0.4.16.
Are these vulnerabilities being exploited?
No. Cisco found them during internal testing and they are not known to be actively exploited.
What should organizations do?
Update to the fixed versions immediately. Check for affected Cisco products in your environment.
