Cisco Patches 15 Vulnerabilities Across Crosswork, Secure Workload and Other Products
Summary
Cisco patched 15 vulnerabilities across its products, including critical flaws in Crosswork and Secure Workload and a remotely exploitable BroadWorks XML parser flaw. Cisco says it is unaware of exploitation in the wild.
Key points
- Crosswork 7.2.1-SP fixes four critical CVEs; three carry CVSS scores of 10.0 and one scores 9.9.
- The Crosswork flaws involve SQL injection, missing authentication, file-system control and credential protection; potential impacts include remote code execution and authentication bypass.
- Secure Workload versions 4.0.4.16 and 3.10.9.1 address five CVEs, including critical access-control, authentication, command-injection, path-traversal and buffer-overflow issues.
- A BroadWorks XML parser flaw, CVE-2026-20320, could let unauthenticated remote attackers read sensitive files using crafted XML; Cisco fixed it in version RI.2026.07 of four products.
- Cisco also fixed medium-severity flaws in Unified Intelligence Center, RoomOS, IE 1000 switches, and contact-center products.
- Cisco says it is not aware of exploitation of the vulnerabilities in the wild.
Article Details
- Event Type
- Cisco security vulnerability disclosure and patch release
- Impact
- Cisco released fixes for vulnerabilities across multiple products, including critical flaws in Crosswork and Secure Workload and a high-severity BroadWorks flaw. Successful exploitation could potentially enable remote code execution, authentication bypass, path traversal, file modification or deletion, and access to sensitive configuration information. Cisco says it is not aware of exploitation in the wild.
CVE
CVE-2026-20030Vendor / Product unavailableThree of them, CVE-2026-20030, CVE-2026-20357, and CVE-2026-20358, have a maximum severity rating (CVSS score of 10/10), while the fourth, CVE-2026-20359, has a near-max severity (CVSS score of 9.9/10).CVE-2026-20231Vendor / Product unavailableCVE-2026-20317 cover improper access control and authentication bugs potentially leading to bypasses; CVE-2026-20231 groups code/OS command injections; and CVE-2026-20318 covers input validation and path traversalCVE-2026-20315Vendor / Product unavailableCVE-2026-20315 and CVE-2026-20317 cover improper access control and authentication bugs potentially leading to bypasses; CVE-2026-20231 groups code/OS command injections; and CVE-2026-20318 covers input validation andCVE-2026-20317Vendor / Product unavailableCVE-2026-20315 and CVE-2026-20317 cover improper access control and authentication bugs potentially leading to bypasses; CVE-2026-20231 groups code/OS command injections; and CVE-2026-20318 covers input validation andCVE-2026-20318Vendor / Product unavailablebugs potentially leading to bypasses; CVE-2026-20231 groups code/OS command injections; and CVE-2026-20318 covers input validation and path traversal issues.CVE-2026-20319Vendor / Product unavailableThe fifth CVE covers buffer overflows and out-of-bounds write issues, collectively tracked as CVE-2026-20319.CVE-2026-20320Vendor / Product unavailableTracked as CVE-2026-20320, it existed because external entity resolution was allowed by default, allowing attackers to send crafted XML messages and view sensitive files with BroadWorks user privileges.CVE-2026-20357Vendor / Product unavailableThree of them, CVE-2026-20030, CVE-2026-20357, and CVE-2026-20358, have a maximum severity rating (CVSS score of 10/10), while the fourth, CVE-2026-20359, has a near-max severity (CVSS score of 9.9/10).CVE-2026-20358Vendor / Product unavailableThree of them, CVE-2026-20030, CVE-2026-20357, and CVE-2026-20358, have a maximum severity rating (CVSS score of 10/10), while the fourth, CVE-2026-20359, has a near-max severity (CVSS score of 9.9/10).CVE-2026-20359Vendor / Product unavailableThree of them, CVE-2026-20030, CVE-2026-20357, and CVE-2026-20358, have a maximum severity rating (CVSS score of 10/10), while the fourth, CVE-2026-20359, has a near-max severity (CVSS score of 9.9/10).
Vendors
Products
BroadWorksCisco also resolved a high-severity security defect in the Open Client Interface (OCI) XML parser of BroadWorks that could be exploited remotely without authentication to read sensitive configuration information.BroadWorks Application Delivery PlatformThe flaw was resolved in version RI.2026.07 of BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform.BroadWorks Application ServerThe flaw was resolved in version RI.2026.07 of BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform.BroadWorks Profile ServerThe flaw was resolved in version RI.2026.07 of BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform.BroadWorks Xtended Services PlatformThe flaw was resolved in version RI.2026.07 of BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform.CrossworkCisco on Wednesday announced patches for 15 vulnerabilities across its products, including critical- and high-severity flaws in Crosswork and Secure Workload.Industrial Ethernet (IE) 1000 series switchesout fixes for medium-severity weaknesses in Unified Intelligence Center, RoomOS, Industrial Ethernet (IE) 1000 series switches, and Packaged Contact Center Enterprise (CCE) and Unified Contact Center EnterprisePackaged Contact Center Enterprise (CCE)Unified Intelligence Center, RoomOS, Industrial Ethernet (IE) 1000 series switches, and Packaged Contact Center Enterprise (CCE) and Unified Contact Center Enterprise (CCE).RoomOSAdditionally, the company rolled out fixes for medium-severity weaknesses in Unified Intelligence Center, RoomOS, Industrial Ethernet (IE) 1000 series switches, and Packaged Contact Center Enterprise (CCE) and UnifiedSecure WorkloadCisco on Wednesday announced patches for 15 vulnerabilities across its products, including critical- and high-severity flaws in Crosswork and Secure Workload.Unified Contact Center Enterprise (CCE)Ethernet (IE) 1000 series switches, and Packaged Contact Center Enterprise (CCE) and Unified Contact Center Enterprise (CCE).Unified Intelligence CenterAdditionally, the company rolled out fixes for medium-severity weaknesses in Unified Intelligence Center, RoomOS, Industrial Ethernet (IE) 1000 series switches, and Packaged Contact Center Enterprise (CCE) and Unified