CVE-2026-20357: Cisco Crosswork missing authentication for critical functions

CVE-2026-20357 · Severity: critical · CVSS 10 · Published 2026-08-19

Cisco Crosswork is a network management and orchestration platform used by service providers to manage critical infrastructure. This vulnerability allows unauthenticated attackers to perform critical functions without any credentials, potentially compromising network operations, enabling unauthorized configuration changes, and exposing sensitive network data. The vulnerability affects multiple Crosswork components (Data Gateway, Network Controller, Planning, and Workflow Manager) and requires a software patch to remediate.

Technologies: Cisco Crosswork Network Controller, Cisco Crosswork Planning, Cisco Crosswork Workflow Manager, Cisco Crosswork Data Gateway. Vendors: Cisco.

Quick answers

Is CVE-2026-20357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20357 being exploited in the wild.
How severe is CVE-2026-20357?
Critical severity, with a CVSS score of 10, published 19 August 2026.
Which products and versions are affected?
Cisco Crosswork Network Controller 7.2.1 and earlier; Cisco Crosswork Planning 7.2.1 and earlier; Cisco Crosswork Workflow Manager 2.1.1 and earlier; Cisco Crosswork Data Gateway 7.2.1 and earlier.
Is there a fix for CVE-2026-20357?
A patch was published on 2026-08-19: Fixed releases available: 7.2.1-SP for Data Gateway, Network Controller, Planning; 2.1.1-SP for Workflow Manager Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20357 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-20357?
Check whether you run Cisco Crosswork Network Controller, Cisco Crosswork Planning, Cisco Crosswork Workflow Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication issue (CWE-306) affecting Cisco Crosswork platforms versions 7.2.1 and earlier (and Workflow Manager 2.1.1 and earlier). It allows attackers to access critical functions over the network without providing authentication credentials, achieving high impact across confidentiality, integrity, and availability. The attack vector is network-based with no authentication required and no user interaction needed. Patches are available in Crosswork 7.2.1-SP and Workflow Manager 2.1.1-SP. These vulnerabilities were discovered during internal security testing and are not currently known to be exploited in the wild.

Affected products

  • Cisco Crosswork Data Gateway 7.2.1 and earlier
  • Cisco Crosswork Network Controller 7.2.1 and earlier
  • Cisco Crosswork Planning 7.2.1 and earlier
  • Cisco Crosswork Workflow Manager 2.1.1 and earlier

Timeline

  • 2026-08-19: disclosed: Initial public release of advisory
  • 2026-08-19: patched: Fixed releases available: 7.2.1-SP for Data Gateway, Network Controller, Planning; 2.1.1-SP for Workflow Manager
  • 2026-08-21: advisory: Advisory updated to include Workflow Manager as affected product

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.