【Vulnerability Alert】Cisco Crosswork Contains Four Critical Cybersecurity Vulnerabilities
Source: Ministry of education information & communication security contingency platform
"" "" ""
| Publication Number | TACERT-ANA-2026082104085252 | Publication Time | 2026-08-21 16:32:55 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-08-21 16:32:55 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】Cisco Crosswork Contains Four Critical Cybersecurity Vulnerabilities |
|||
| [Content]
Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202608-00000016 The Cisco Crosswork development team discovered multiple security vulnerabilities during an internal security review and has completed remediation. Currently, there is no evidence indicating that these vulnerabilities are being actively exploited. To assist customers in deploying security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly released the relevant vulnerability information and remediation recommendations. CVE-2026-20030 (CVSS: 10.0) is an Improper Neutralization of Special Elements used in an SQL Command vulnerability; CVE-2026-20357 (CVSS: 10.0) is a Missing Authentication for Critical Function vulnerability; CVE-2026-20358 (CVSS: 10.0) is an External Control of File Name or Path vulnerability; CVE-2026-20359 (CVSS: 9.8) is an Insufficiently Protected Credentials vulnerability. Information Sharing Level: WHITE (the intelligence content is information that may be publicly disclosed) |
|||
| [Affected Platform]
Cisco Crosswork version 7.2.1 and earlier |
|||
|
[Recommended Actions] Please update to Cisco Crosswork version 7.2.1-SP or later. |
|||
|
[Reference] |
|||
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw