CVE-2026-20030
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in Cisco Crosswork related to improper neutralization of special elements used in a SQL command (CWE-89), i.e., SQL injection. Discovered during internal security review, fixed in hardening release.
Risk Assessment
An attacker may inject malicious SQL code, potentially leading to unauthorized database access, data modification, or deletion.
Recommendation
Install the latest Cisco Crosswork version with security fixes.
Other vulnerabilities in Cisco Crosswork
See all- CVE-2026-20359Critical
Vulnerability in Cisco Crosswork related to insufficiently protected credentials (CWE-522). It was discovered during an internal security review and addressed in a hardening release.
- CVE-2026-20358Critical
Vulnerability in Cisco Crosswork related to external control of file system (CWE-73). Discovered during internal security review, fixed in hardening release.
- CVE-2026-20357Critical
Vulnerability in Cisco Crosswork due to missing authentication for critical functions (CWE-306). Discovered during internal security review, fixed in hardening release.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20030 are related to improper neutralization of special elements used in a SQL command issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS