Cisco's control planes are the exposure: four criticals in Crosswork, four in Secure Workload

Cisco released patches on Wednesday for 15 vulnerabilities across its portfolio, including critical- and high-severity flaws in Crosswork and Secure Workload ^[1]. The products carrying the worst of it are not edge devices or endpoints but the platforms that sit above production and tell it what to do.

Crosswork 7.2.1-SP fixes four critical CVEs ^[2]. Three of them, CVE-2026-20030, CVE-2026-20357 and CVE-2026-20358, carry a CVSS score of 10 out of 10 ^[3]; the fourth, CVE-2026-20359, is rated 9.9 ^[4]. The first three cover SQL injection, missing authentication, and external control of the file system, while the fourth includes insufficient protection of credentials ^[8]. Cisco says successful exploitation could allow remote code execution, authentication bypass, path traversal, and file overwrite or deletion ^[9]. That is the full set on a network automation platform, and the credential-protection item in the mix means the thing an attacker would go looking for is stored where the other three bugs reach.

Secure Workload 4.0.4.16 and 3.10.9.1 fix five CVEs, four of them rated critical ^[6]. CVE-2026-20315 and CVE-2026-20317 cover improper access control and authentication bugs that could lead to bypasses ^[10]; CVE-2026-20231 groups code and OS command injection ^[11]; CVE-2026-20318 covers input validation and path traversal ^[12]. The fifth, CVE-2026-20319, covers buffer overflows and out-of-bounds writes ^[13].

One detail is worth more than the scores. According to Cisco, each of these CVE identifiers groups multiple issues under the same underlying vulnerability class ^[5]. So the CVE count is a taxonomy decision, not a defect count, and anyone reconciling this against an internal patch ticket should assume the remediation surface inside each identifier is larger than one bug. Across the two platforms that is eight critical-rated identifiers to absorb in a single cycle ^[17].

Separately, Cisco fixed a high-severity flaw in the Open Client Interface XML parser in BroadWorks, CVE-2026-20320, exploitable remotely without authentication to read sensitive configuration information ^[14]. The cause was mundane: external entity resolution was allowed by default, so crafted XML messages could be used to view files with BroadWorks user privileges ^[15]. Fixes landed in version RI.2026.07 of the BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform ^[16]. The remaining fixes are medium-severity issues in Unified Intelligence Center, RoomOS, the Industrial Ethernet 1000 series switches, and Packaged and Unified Contact Center Enterprise ^[18]. If Cisco's count of 15 maps one to one with the named CVEs, that leaves five spread across those four product lines ^[19].

Cisco says it is not aware of any of these vulnerabilities being exploited in the wild ^[7].

What to watch: whether the Crosswork and Secure Workload advisories draw exploitation activity, given that a 10.0 with missing authentication on an orchestration platform is the kind of target that gets reverse-engineered from the patch diff. Also watch how your own asset inventory treats these systems. Management and segmentation-policy platforms are frequently exempted from the maintenance windows applied to the infrastructure they govern, which is exactly the wrong way round this week.