Cisco Fixes Four Critical Crosswork Planning Vulnerabilities

Cisco has published a critical security hardening advisory covering four vulnerabilities in Cisco Crosswork Planning. Three have a CVSS score of 10.0 and one scores 9.9.

The vulnerabilities were identified during Cisco's internal security testing and are not known to be actively exploited. There are no workarounds, so affected organisations should upgrade without delay.

Overview

• CVE: CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, CVE-2026-20359

• Severity: Critical

• Highest CVSS score: 10.0

• Publication date: 19 August 2026

• Exploitation status: Not known to be actively exploited

• Workarounds: None

Affected versions

• Affected: Cisco Crosswork releases 7.2.1 and earlier

• Fixed: Cisco Crosswork release 7.2.1-SP

Vulnerability breakdown

CVE-2026-20030 — SQL command injection

• CVSS: 10.0

• Weakness: Improper neutralisation of special elements used in an SQL command (CWE-89).

CVE-2026-20357 — Missing authentication

• CVSS: 10.0

• Weakness: Missing authentication for a critical function (CWE-306).

CVE-2026-20358 — External file-system control

• CVSS: 10.0

• Weakness: External control of the file system (CWE-73).

CVE-2026-20359 — Insufficiently protected credentials

• CVSS: 9.9

• Weakness: Insufficiently protected credentials (CWE-522).

Cisco does not provide CVE-specific impact details or exploitation prerequisites in the advisory.

Mitigation

• Upgrade Cisco Crosswork 7.2.1 and earlier to release 7.2.1-SP.

• Prioritise the update because no workaround is available.

• Follow normal change control and confirm the installed version after deployment.

Reference

• Cisco Crosswork Security Hardening Release: August 2026

Need help?

Secure ISS can help your organisation assess affected Cisco deployments, plan upgrades and validate remediation. Call 1300 769 460 or contact the Secure ISS SOC team.