Cisco Releases Emergency Patches for Critical Vulnerabilities in Crosswork and Secure Workload

Cisco has released emergency patches for several critical vulnerabilities in its Crosswork network automation platform. The most severe flaw, CVE-2026-20030, has a perfect CVSS score of 10.0 and allows an attacker to manipulate backend database queries, potentially leading to further system compromise.

The vulnerability is not isolated but rather one of three critical bugs disclosed this week that share the same top-tier risk rating. Cisco's advisory groups several related SQL injection issues in Crosswork under this one CVE identifier. The result is that an attacker who successfully exploits CVE-2026-20030 could execute code on the system, bypass login controls, and tamper with files.

Cisco has no evidence of exploitation of these vulnerabilities but advises immediate patching due to the high risk of attack. The company's advisory also mentions a critical flaw in Secure Workload, which carries the same kind of downstream risk as a Crosswork compromise.