Cisco administrators have a short, unambiguous job: inventory affected Crosswork and Secure Workload systems, then install the fixed releases. Cisco’s August hardening advisories cover nine CVE groupings, including five whose maximum potential severity is CVSS 10.0. Cisco says fixed software is available and no workaround addresses the vulnerabilities.
What Cisco disclosed
This is not a disclosure of nine neatly separated exploit chains. Cisco says its engineering teams found multiple vulnerabilities during internal security reviews, grouped the findings by their highest-level Common Weakness Enumeration class, and assigned one CVE ID to each grouping. The score shown for a grouping is the maximum potential severity of the most impactful underlying vulnerability in that class.
That distinction matters. “Nine vulnerabilities” is convenient shorthand, but the more precise description is nine CVE groupings covering multiple internally discovered vulnerabilities. The advisories identify weakness classes, affected products and fixed releases; they do not publish a complete attack narrative or prove that every underlying issue is remotely exploitable without authentication.
Phone readers: swipe the table left to view every column.
| Product family | CVE grouping | Maximum CVSS | Weakness class | Affected deployment scope |
|---|---|---|---|---|
| Crosswork | CVE-2026-20030 | 10.0 | SQL command injection class (CWE-89) | Data Gateway, Network Controller, Planning and Workflow Manager |
| Crosswork | CVE-2026-20357 | 10.0 | Missing authentication for critical function (CWE-306) | Same Crosswork scope |
| Crosswork | CVE-2026-20358 | 10.0 | External control of file system (CWE-73) | Same Crosswork scope |
| Crosswork | CVE-2026-20359 | 9.9 | Insufficiently protected credentials (CWE-522) | Same Crosswork scope |
| Secure Workload | CVE-2026-20231 | 9.9 | Command, OS command or argument injection class (CWE-74) | SaaS and on-premises deployments |
| Secure Workload | CVE-2026-20315 | 10.0 | Improper access control (CWE-284) | SaaS and on-premises deployments |
| Secure Workload | CVE-2026-20317 | 10.0 | Improper authentication (CWE-287) | SaaS and on-premises deployments |
| Secure Workload | CVE-2026-20318 | 9.6 | Input validation and path-control class (CWE-20) | SaaS and on-premises deployments |
| Secure Workload | CVE-2026-20319 | 7.5 | Buffer-bounds class (CWE-119) | SaaS and on-premises deployments |
Crosswork: the affected list changed on August 21
Cisco’s revision history is operationally important. Revision 2.0 added Crosswork Workflow Manager to the affected-product list, so an earlier summary that mentions only Data Gateway, Network Controller and Planning is incomplete.
First fixed Crosswork releases
- Crosswork Data Gateway 7.2.1 and earlier: 7.2.1-SP
- Crosswork Network Controller 7.2.1 and earlier: 7.2.1-SP
- Crosswork Planning 7.2.1 and earlier: 7.2.1-SP
- Crosswork Workflow Manager 2.1.1 and earlier: 2.1.1-SP
Do not stop at checking a “Crosswork 7.2.1” label. Workflow Manager follows a different version line, and Cisco added it only in the revised advisory. Confirm the exact installed product and component, not just the broader platform name.
Secure Workload: SaaS customers still have work to do
Cisco says Secure Workload SaaS and on-premises deployments are affected regardless of device configuration. The first fixed releases are 3.10.9.1 for release 3.10 and earlier, and 4.0.4.16 for release 4.0.
For on-premises environments, Cisco says the Cluster, Agent and Connector software must all be upgraded to resolve the covered vulnerabilities. For SaaS, Cisco has upgraded the Cluster, but customers remain responsible for upgrading their Agent and Connector software. “Cisco hosts it” therefore does not mean every customer-side component is already remediated.
Why “no workaround” changes the response
Hardening can reduce exposure, but it is not the fix
Restricting management access, isolating administrative interfaces and monitoring logs are prudent risk-reduction measures. Cisco explicitly says there are no workarounds, so those controls must not be presented as substitutes for installing fixed software.
The practical priority should be based on exposure, business criticality, maintenance requirements and the affected component—not on the score alone. CVSS 10.0 describes maximum potential technical severity. It does not, by itself, establish active exploitation, public proof-of-concept code or the exact likelihood of compromise in a particular network.
Managed-service providers and internal IT teams should also identify the business owner for each deployment before maintenance begins. Crosswork may sit inside network-planning and orchestration workflows, while Secure Workload supports segmentation and policy enforcement. An emergency update that is technically correct can still disrupt operations if connectors, agents, integrations or failover dependencies are missed. Record the owner, maintenance contact, expected health checks and rollback decision point for every affected environment.
A safe patch plan for administrators
- Inventory exact products and versions. Include Workflow Manager separately, and identify every Secure Workload Cluster, Agent and Connector.
- Read Cisco’s live advisory before maintenance. Check for another revision, supported upgrade paths, prerequisites and release notes.
- Confirm entitlement and compatibility. Validate licensing, appliance or virtual-platform requirements, integrations and rollback procedures.
- Back up configurations and record health. Preserve the state needed to recover, plus current versions and service checks.
- Schedule the maintenance window. Coordinate clusters, connectors, agents and dependent orchestration services so partial upgrades do not create avoidable disruption.
- Install Cisco’s fixed releases. Use 7.2.1-SP for the three affected Crosswork 7.2.1 product lines, 2.1.1-SP for Workflow Manager, and 3.10.9.1 or 4.0.4.16 for the applicable Secure Workload line.
- Verify, do not assume. Read back versions, test service health and integrations, confirm agents and connectors are communicating, and review logs for anomalies.
- Keep monitoring. Recheck Cisco PSIRT and CISA KEV for status changes. Catalog absence today is not a guarantee about tomorrow.
What is known—and what remains unknown
Known: Cisco attributes the findings to internal testing, provides fixed software, states there are no workarounds, and says it was not aware of public announcements or malicious use at advisory time.
Not established: active exploitation, a public exploit, a single shared attack path across all groupings, or unauthenticated remote reachability for every underlying vulnerability. Cisco’s grouped disclosure does not provide enough detail to make those broader claims responsibly.
CISA context: none of these nine CVE IDs appeared in the live KEV catalog during our final check. KEV is a catalog of vulnerabilities known to have been exploited in the wild; an ID’s absence should never be treated as proof that exploitation is impossible.
Frequently asked questions
Are these vulnerabilities being actively exploited?
Cisco says they were not known to be actively exploited at advisory time. We found none of the nine CVE IDs in CISA KEV at the reporting cutoff. Both facts are time-sensitive and neither guarantees that exploitation cannot begin later.
Does a CVSS 10.0 score mean a system has already been breached?
No. It is a severity score, not breach evidence. Administrators should patch promptly and investigate any suspicious activity based on their own exposure and telemetry.
Is a Secure Workload SaaS tenant fully fixed automatically?
Not necessarily. Cisco says it upgraded the SaaS Cluster, while customers still need to upgrade Agent and Connector software.
Can firewall rules replace the update?
No. Restrictions and isolation can reduce risk, but Cisco states there are no workarounds that address these vulnerabilities.
Which Crosswork detail is easiest to miss?
Crosswork Workflow Manager. Cisco added it in advisory revision 2.0, with 2.1.1-SP as the first fixed release.
Open Cisco’s live Crosswork advisory
Sources
- Cisco — “Cisco Crosswork Security Hardening Release: August 2026”, including revision 2.0 adding Workflow Manager.
- Cisco — “Cisco Secure Workload Software Security Hardening Release: August 2026”.
- CISA — Known Exploited Vulnerabilities Catalog.
Reporting cutoff: August 21, 2026 at 7:00 p.m. EDT / 23:00 UTC. Cisco’s live advisories and CISA’s machine-readable KEV catalog were refreshed immediately before drafting and publication preflight. This article describes defensive patching only and intentionally omits exploit instructions.