Cisco Fixes 15 Vulnerabilities: Critical Risk for Crosswork and Secure Workload

Cisco has released updates for 15 vulnerabilities affecting network management, workload security, enterprise communications, and contact center platforms. The flaws include SQL injection, authentication bypass, path traversal, command injection, buffer overflow, and XML-based file disclosure.

The most serious issues affect Cisco Crosswork and Cisco Secure Workload. Four Crosswork vulnerabilities have CVSS scores ranging from 9.9 to 10.0. Cisco says it has no evidence that the flaws have been exploited in the wild.

Crosswork: Four Critical Flaws in the Management Platform

Cisco Crosswork version 7.2.1-SP addresses four critical vulnerabilities:

• CVE-2026-20030: SQL injection, CVSS 10.0;
• CVE-2026-20357: missing authentication, CVSS 10.0;
• CVE-2026-20358: external control of the file system, CVSS 10.0;
• CVE-2026-20359: inadequate credential protection, CVSS 9.9.

The first three flaws can be exploited remotely, require no authentication or user interaction, and may compromise the confidentiality, integrity, and availability of affected systems. The fourth vulnerability requires initial privileges but still has a very high impact.

Cisco says each CVE groups multiple issues from the same vulnerability class. Successful exploitation could enable remote code execution, bypass authentication controls, traverse file system paths, and overwrite or delete files.

The risk therefore extends beyond platform availability. An attacker could use Crosswork as an entry point to administrative functions or modify data and files used by management components.

Secure Workload Combines Access Control and Injection Issues

Cisco has released two fixed versions for Secure Workload:

• 4.0.4.16;
• 3.10.9.1.

The updates address five CVEs. The first four are rated critical:

• CVE-2026-20315: access control and authentication flaws that could enable a bypass; CVSS 10.0;
• CVE-2026-20317: additional authorization and authentication issues that could also be exploited to bypass controls; CVSS 10.0;
• CVE-2026-20231: code injection and OS command injection; CVSS 9.9;
• CVE-2026-20318: insufficient input validation and path traversal; CVSS 9.6;
• CVE-2026-20319: buffer overflow and out-of-bounds memory writes.

Available data indicates that the first three vulnerabilities with known scores can be reached over the network without authentication in the case of the access control issues, while the code injection associated with CVE-2026-20231 requires initial privileges. Potential impact includes data compromise, information modification, and service disruption.

The combination of authorization bypasses and injection primitives increases operational risk. An attacker could first circumvent application controls and then use commands or manipulated code to affect the underlying environment.

No individual CVSS score is provided for CVE-2026-20319. However, the flaw affects memory and could cause data corruption, crashes, or unexpected application behavior.

BroadWorks Exposes Files Through External XML Entities

Cisco also fixed CVE-2026-20320, a high-severity vulnerability in the BroadWorks Open Client Interface (OCI) XML parser.

The issue is caused by external entity resolution being enabled by default. An unauthenticated remote attacker can send specially crafted XML messages and trick the system into reading local files. The contents are then returned with the privileges of a BroadWorks user, potentially exposing configuration data and other sensitive information.

The flaw is a form of XML External Entity (XXE) injection. Successful exploitation depends on which files are accessible to the process and the privileges available in the installation, but it does not necessarily require a valid account.

The fix is included in release RI.2026.07 for the following components:

• BroadWorks Application Delivery Platform;
• BroadWorks Application Server;
• BroadWorks Profile Server;
• BroadWorks Xtended Services Platform.

Operators should verify the release of each component because the update applies to the entire set identified by Cisco.

The Remaining Flaws Affect Contact Center, RoomOS, and Industrial Switches

The package also includes medium-severity vulnerabilities in:

• Unified Intelligence Center;
• RoomOS;
• Industrial Ethernet (IE) 1000 Series switches;
• Packaged Contact Center Enterprise (CCE);
• Unified Contact Center Enterprise (CCE).

For these products, CVE identifiers, fixed builds, and technical descriptions are not available. Based on the published information, it is therefore not possible to determine which components are exposed, what the attack vector is, or whether exploitation requires specific conditions.

Cisco fixed a total of 15 vulnerabilities. Detailed information focuses on the three most significant groups: Crosswork, Secure Workload, and BroadWorks.

What Administrators Should Do

The priority updates are:

• Crosswork 7.2.1-SP;
• Secure Workload 4.0.4.16 or 3.10.9.1;
• BroadWorks RI.2026.07 for the four affected components.

After installation, administrators should verify that the running version matches the fixed release, including on secondary nodes, appliances, and distributed components. For Crosswork and Secure Workload, exposure of administrative interfaces to untrusted networks should be reviewed urgently.

For BroadWorks, logs should be examined for anomalous OCI requests, XML messages containing external entity declarations, and unusual access to configuration files. No official indicators of compromise or specific detection rules have been provided.

For Unified Intelligence Center, RoomOS, IE 1000 Series, and the two CCE platforms, consult the Cisco advisories relevant to each deployment and apply the builds specified by the vendor. No temporary workarounds have been disclosed.

It is not known whether these vulnerabilities are listed in CISA’s KEV catalog; consequently, no listing date or CISA remediation deadline is currently available. Cisco also reports no active exploitation campaigns. The absence of evidence does not eliminate the risk: maximum CVSS scores and remotely exploitable flaws make these updates a priority for exposed environments.