Is CVE-2026-20188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20188 being exploited in the wild.

How severe is CVE-2026-20188?

Informational severity, with a CVSS score of 0, published 6 May 2026.

Which products and versions are affected?

Cisco Crosswork Network Controller; Cisco Network Services Orchestrator (NSO).

Is there a fix for CVE-2026-20188?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20188 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20188?

Check whether you run Cisco Crosswork Network Controller or Cisco Network Services Orchestrator. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20188: Cisco Crosswork Network Controller and NSO resource management issue

CVE-2026-20188 · Severity: info · CVSS 0 · Published 2026-05-06

Cisco has reclassified a previously reported security vulnerability in its Crosswork Network Controller and Network Services Orchestrator as a non-security resource management issue. Originally thought to be a flaw allowing attackers to crash the system, further analysis determined the behavior is related to how customers configure system resources. There is no security risk to customer data or operations beyond standard performance tuning and resource allocation requirements.

Technologies: Cisco Crosswork Network Controller. Vendors: Cisco.

Quick answers

Is CVE-2026-20188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20188 being exploited in the wild.
How severe is CVE-2026-20188?: Informational severity, with a CVSS score of 0, published 6 May 2026.
Which products and versions are affected?: Cisco Crosswork Network Controller; Cisco Network Services Orchestrator (NSO).
Is there a fix for CVE-2026-20188?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20188 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20188?: Check whether you run Cisco Crosswork Network Controller or Cisco Network Services Orchestrator. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Initially reported as a denial of service (DoS) vulnerability (CWE-400) due to inadequate rate-limiting on incoming network connections, Cisco PSIRT has since reclassified this issue. The behavior, which could lead to resource exhaustion and require a manual reboot, was determined to be a matter of system sizing and resource management rather than a flaw in the software's security architecture. The CVSS score has been updated to 0.0 as the condition is dependent on customer-controlled resource allocation and performance optimization settings. No patch is required, but Cisco recommends following official documentation for scaling RAM and disk resources in large-scale deployments.

Affected products

Cisco Crosswork Network Controller
Cisco Network Services Orchestrator (NSO)

Timeline

2026-05-06: disclosed: Initial public release of the advisory.
2026-05-14: other: Advisory updated to reclassify the issue from a security vulnerability to an informational resource management issue.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-dos-7Egqyc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.