CVE-2026-20030: Cisco Crosswork SQL injection in multiple products

CVE-2026-20030 · Severity: critical · CVSS 10 · Published 2026-08-19

Cisco Crosswork is a suite of network management and orchestration platforms used by telecommunications operators. Multiple critical vulnerabilities in these products allow unauthenticated remote attackers to execute arbitrary SQL commands, bypass authentication, manipulate files, and steal credentials. These vulnerabilities could result in complete compromise of the platform, unauthorized access to network data, and service outages affecting operational networks.

Technologies: Cisco Crosswork Network Controller, Cisco Crosswork Planning, Cisco Crosswork Workflow Manager, Cisco Crosswork Data Gateway. Vendors: Cisco.

Quick answers

Is CVE-2026-20030 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20030 being exploited in the wild.
How severe is CVE-2026-20030?
Critical severity, with a CVSS score of 10, published 19 August 2026.
Which products and versions are affected?
Cisco Crosswork Network Controller 7.2.1 and earlier; Cisco Crosswork Planning 7.2.1 and earlier; Cisco Crosswork Workflow Manager 2.1.1 and earlier; Cisco Crosswork Data Gateway 7.2.1 and earlier.
Is there a fix for CVE-2026-20030?
A patch was published on 2026-08-19: Fixed versions available: 7.2.1-SP (Data Gateway, Network Controller, Planning) and 2.1.1-SP (Workflow Manager) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20030 attacked?
It is attacked over the network.
Am I affected by CVE-2026-20030?
Check whether you run Cisco Crosswork Network Controller, Cisco Crosswork Planning, Cisco Crosswork Workflow Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-20030 addresses improper neutralization of special characters in SQL commands (CWE-89) across the Cisco Crosswork product suite, allowing SQL injection attacks. The advisory also covers related critical vulnerabilities including missing authentication for critical functions (CWE-306), external file system control (CWE-73), and insufficient credential protection (CWE-522). These vulnerabilities were discovered during internal security review using both traditional testing processes and AI-assisted analysis. The vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning, and Crosswork Workflow Manager in versions 7.2.1 and earlier (2.1.1 for Workflow Manager). All vulnerabilities are remotely exploitable with no authentication required and carry CVSS scores of 9.9–10.0. Patches are available in version 7.2.1-SP and 2.1.1-SP; no workarounds exist.

Affected products

  • Cisco Crosswork Data Gateway 7.2.1 and earlier
  • Cisco Crosswork Network Controller 7.2.1 and earlier
  • Cisco Crosswork Planning 7.2.1 and earlier
  • Cisco Crosswork Workflow Manager 2.1.1 and earlier

Timeline

  • 2026-08-19: disclosed: Initial public release of advisory
  • 2026-08-21: advisory: Advisory updated to include Crosswork Workflow Manager
  • 2026-08-19: patched: Fixed versions available: 7.2.1-SP (Data Gateway, Network Controller, Planning) and 2.1.1-SP (Workflow Manager)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.