Cisco issues emergency patches for Crosswork and Secure Workload
Cisco released urgent patches for 15 vulnerabilities, including four critical Crosswork 7.2.1‑SP flaws (three rated 10.0) and five Secure Workload CVEs that could enable RCE and authentication bypass.
On Wednesday, Cisco released emergency patches addressing 15 security vulnerabilities across its product portfolio, including critical fixes for Crosswork and Secure Workload.
Crosswork version 7.2.1‑SP received fixes that resolve four grouped CVEs: CVE-2026-20030, CVE-2026-20357 and CVE-2026-20358, each assigned a 10.0 CVSS score, and CVE-2026-20359, rated 9.9. Each CVE consolidates multiple underlying issues, including SQL injection, missing authentication checks, external control of file system behavior and insufficient protection of credentials. Successful exploitation could allow remote code execution, authentication bypass, path traversal and file overwrite or deletion.
Secure Workload updates, released as versions 4.0.4.16 and 3.10.9.1, address five grouped CVEs. CVE-2026-20315 and CVE-2026-20317 cover improper access controls and authentication weaknesses that can produce bypasses. CVE-2026-20231 groups multiple code and operating-system command injection issues. CVE-2026-20318 relates to input validation and path traversal, while CVE-2026-20319 aggregates buffer overflow and out-of-bounds write defects. These defects can expose systems to remote code execution and privilege bypass.
Cisco also patched a high-severity issue in the Open Client Interface XML parser used by BroadWorks, tracked as CVE-2026-20320. The defect existed because XML external entity resolution was enabled by default, which allowed unauthenticated attackers to submit crafted XML and read sensitive configuration files with BroadWorks privileges. The fix is included in release RI.2026.07 for BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server and BroadWorks Xtended Services Platform.
Additional medium-severity fixes were released for Unified Intelligence Center, RoomOS, Industrial Ethernet (IE) 1000 series switches, and Packaged and Unified Contact Center Enterprise products. Cisco reported it is not aware of active exploitation of these vulnerabilities in the wild.
Cisco published mitigation guidance and urged customers to apply the updates listed on its security advisories page. Organizations are advised to prioritize patching Crosswork and Secure Workload instances exposed to untrusted networks, validate updates in test environments before wide deployment, restrict access to management interfaces and disable unnecessary XML external entity processing where possible until systems are updated.
Articles by this author
