Cisco has released a critical security hardening update for its Crosswork networking platform after uncovering multiple vulnerabilities that could, in the worst-case scenario, allow attackers to bypass authentication, access sensitive information, manipulate files, or compromise affected systems.
The advisory, published on August 19, 2026, carries a maximum CVSS score of 10.0, the highest possible severity rating. Cisco says the vulnerabilities were discovered through internal security testing, including testing assisted by frontier AI models.
Importantly, Cisco says it is not aware of active exploitation or public malicious use of the flaws at this time.
That does not mean organizations should wait.
The company has confirmed that there are no workarounds that address the vulnerabilities and strongly recommends upgrading affected Crosswork deployments to the fixed release, Crosswork 7.2.1-SP.
Four vulnerabilities put Crosswork deployments at risk
The security hardening release addresses four vulnerability groups affecting Cisco Crosswork platforms.
The affected products are:
- Cisco Crosswork Data Gateway
- Cisco Crosswork Network Controller
- Cisco Crosswork Planning
The vulnerabilities are tracked under four CVE identifiers:
CVE-2026-20030 has a maximum CVSS score of 10.0 and is associated with CWE-89, which covers improper neutralization of special elements used in SQL commands. In practical terms, this type of vulnerability can create a path for malicious input to interfere with database queries.
CVE-2026-20357 is also rated 10.0 and involves CWE-306, or missing authentication for a critical function. Authentication is one of the fundamental barriers protecting sensitive administrative operations, making a flaw in this area particularly serious.
CVE-2026-20358 carries a 10.0 score and falls under CWE-73, external control of the file system. Depending on how such a vulnerability is exploited, an attacker could potentially influence files or system resources that should remain under administrative control.
Finally, CVE-2026-20359 has a CVSS score of 9.9 and is associated with CWE-522, insufficiently protected credentials. Compromised credentials can become particularly dangerous when they provide access to network management systems or other privileged infrastructure.
Cisco has grouped the vulnerabilities according to their underlying weakness categories. The CVSS score assigned to each CVE represents the maximum potential severity of the most impactful vulnerability within that category.
Why this matters beyond Cisco
Crosswork is designed to help organizations manage, automate and monitor network infrastructure. That makes security vulnerabilities in the platform more than a conventional software patching issue.
Network management and orchestration systems can sit close to some of an organization’s most important infrastructure. If an attacker gains privileged access to such a system, the consequences could extend beyond the application itself.
Depending on the environment and the privileges available, successful exploitation could potentially lead to unauthorized access, manipulation of files, exposure of credentials, disruption of network services or further compromise of connected infrastructure.
For security teams, this is why vulnerabilities affecting management and orchestration platforms deserve the same urgency as vulnerabilities affecting externally exposed systems.
A platform does not need to be directly exposed to the public internet to represent a valuable target. Attackers increasingly look for trusted systems and administrative tools that can provide a path deeper into an organization’s environment.
No known exploitation, but no workaround either
One of the most important details in Cisco’s advisory is the current exploitation status.
Cisco PSIRT says it is not aware of public announcements or malicious use of the vulnerabilities described in the advisory.
That is reassuring, but it should not be interpreted as a reason to postpone remediation.
The absence of known exploitation means defenders currently have an opportunity to patch before attackers turn the vulnerabilities into operational threats.
The situation is made more urgent by the fact that Cisco has confirmed there are no workarounds addressing these vulnerabilities.
For organizations running vulnerable releases, the permanent solution is therefore to move to the fixed software.
Cisco Crosswork 7.2.1-SP is the fixed release
Cisco identifies Crosswork 7.2.1-SP as the first fixed release.
Crosswork 7.2.1 and earlier releases are affected according to the advisory.
Organizations should therefore identify their current Crosswork version, confirm whether the deployment falls within the affected range and plan the upgrade to 7.2.1-SP.
Cisco also recommends checking system resources and configuration compatibility before performing the upgrade. Customers should ensure that their infrastructure has sufficient memory and that existing hardware and software configurations remain supported.
Organizations without an active Cisco support arrangement may need to contact Cisco Technical Assistance Center or their contracted maintenance provider to obtain the appropriate upgrade.
Read the full Cisco Security Advisory for the official affected-release and fixed-software information.
AI-assisted security testing is another important signal
There is another detail in this advisory that deserves attention.
Cisco says the vulnerabilities were discovered during internal security testing using existing testing processes as well as frontier AI models.
This is an increasingly important development for the cybersecurity industry.
AI is becoming part of both sides of the security equation. Defenders are using AI to identify weaknesses, analyze large amounts of code and accelerate security testing, while attackers are also exploring AI-assisted methods to discover and exploit vulnerabilities.
The fact that Cisco explicitly references frontier AI models in the discovery process demonstrates how security testing is evolving.
For technology vendors and enterprises alike, automated and AI-assisted vulnerability discovery could increasingly become part of the standard software development and security lifecycle.
What security teams should do now
Organizations operating Cisco Crosswork should treat this advisory as a priority remediation item.
Here are 10 recommended actions:
- Inventory Crosswork deployments
Identify every instance of Crosswork Data Gateway, Crosswork Network Controller and Crosswork Planning operating in the environment.
- Verify the installed version
Confirm whether each deployment is running Crosswork 7.2.1 or an earlier release.
- Prioritize vulnerable systems
Rank systems according to their network exposure, business criticality, privileges and connectivity to sensitive infrastructure.
- Upgrade to Crosswork 7.2.1-SP
Cisco identifies 7.2.1-SP as the first fixed release. Organizations should plan and execute the upgrade as soon as operationally possible.
- Do not rely on a workaround
Cisco has explicitly stated that no workaround addresses these vulnerabilities. Compensating controls should therefore not be treated as a replacement for the vendor-provided fix.
- Review privileged accounts
Because one of the vulnerabilities involves missing authentication for a critical function and another involves credential protection, security teams should review privileged accounts, authentication controls and credential storage around affected systems.
- Inspect logs for suspicious activity
Review authentication events, administrative activity, unusual file operations, unexpected database activity and other anomalous behavior around Crosswork infrastructure.
- Strengthen network segmentation
Ensure network management platforms are appropriately isolated from general user networks and unnecessary external access is restricted.
- Validate the upgrade
After patching, verify the installed version, confirm that critical services remain operational and conduct appropriate security testing to ensure the vulnerability has been remediated.
- Update the incident response plan
Document the advisory, affected assets, remediation status and monitoring requirements. Security teams should also be prepared to investigate quickly if evidence of exploitation emerges.
Why this matters to organizations in the Middle East and Africa
The advisory is global in scope, but it has particular relevance for organizations operating large and increasingly interconnected digital infrastructure across the Middle East and Africa.
Telecommunications operators, government agencies, financial institutions, energy companies, cloud providers and large enterprises increasingly depend on sophisticated network management platforms to operate critical environments.
As digital transformation accelerates across the region, network infrastructure is becoming an increasingly attractive target for threat actors.
For organizations operating critical or highly connected infrastructure, vulnerabilities in network management systems should therefore be treated as infrastructure-security issues rather than isolated application vulnerabilities.
Security leaders should also ensure that patch management is integrated into broader cybersecurity risk management and security operations programs at Saintynet Cybersecurity, rather than handled solely as an IT maintenance task.
Organizations looking to strengthen internal security capabilities should also consider structured cybersecurity training and awareness programs covering vulnerability management, network security, incident response and secure infrastructure operations.
The bigger lesson for security leaders
The Cisco Crosswork advisory highlights a familiar but increasingly important reality: attackers do not always need to target the obvious front door.
Management platforms, orchestration systems and administrative tools can provide powerful access to the infrastructure behind an organization.
That makes vulnerability management particularly important for systems that security teams may consider “internal” or “trusted.”
The absence of known exploitation gives organizations valuable time. But that window can close quickly once technical details become available and threat actors begin testing vulnerable environments.
The responsible approach is therefore straightforward: identify affected systems, upgrade to the fixed release, review privileged access and monitor the environment for suspicious activity.
Conclusion
Cisco’s August 2026 Crosswork security advisory addresses four serious vulnerabilities, three of which carry a maximum CVSS score of 10.0 and one a score of 9.9.
The flaws affect Cisco Crosswork Data Gateway, Crosswork Network Controller and Crosswork Planning. They include weaknesses involving SQL command handling, authentication, file-system control and credential protection.
Cisco says there is currently no evidence of public exploitation, but there are also no workarounds.
For organizations running affected Crosswork releases, the message is clear: this is a patch-now situation, not a wait-and-see situation.
The fixed Crosswork 7.2.1-SP release should be treated as the primary remediation path, while security teams should use the opportunity to review privileged access, segmentation, monitoring and incident-response readiness.
As the cybersecurity industry moves toward increasingly AI-assisted security testing, vulnerabilities may be discovered faster than ever. Organizations that can identify, prioritize and remediate those weaknesses quickly will be in a much stronger position when the next critical advisory arrives.
For more cybersecurity news, threat intelligence and industry analysis, follow CyberCory.
