CVE-2026-20357
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in Cisco Crosswork due to missing authentication for critical functions (CWE-306). Discovered during internal security review, fixed in hardening release.
Risk Assessment
Unauthenticated attacker may perform critical operations, potentially leading to full system compromise.
Recommendation
Update Cisco Crosswork to a patched version.
Other vulnerabilities in Cisco Crosswork
See all- CVE-2026-20359Critical
Vulnerability in Cisco Crosswork related to insufficiently protected credentials (CWE-522). It was discovered during an internal security review and addressed in a hardening release.
- CVE-2026-20358Critical
Vulnerability in Cisco Crosswork related to external control of file system (CWE-73). Discovered during internal security review, fixed in hardening release.
- CVE-2026-20030Critical
Vulnerability in Cisco Crosswork related to improper neutralization of special elements used in a SQL command (CWE-89), i.e., SQL injection. Discovered during internal security review, fixed in hardening release.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20357 are related to missing authentication for critical function issues that are grouped under the Common Weakness Enumeration (CWE) CWE-306.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS