# CVE-2026-20359: Cisco Crosswork insufficiently protected credentials

Source: https://junglewise.ai/threats/cve-2026-20359-cisco-crosswork-insufficiently-protected-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20359 · Severity: critical · CVSS 9.9 · Published 2026-08-19

Cisco Crosswork is a network management platform used to control and optimize enterprise network operations. Multiple vulnerabilities in Crosswork's credential storage and authentication mechanisms could allow attackers to compromise network infrastructure management, leading to unauthorized access to critical network operations, data theft, and potential service disruption.

Technologies: [Cisco Crosswork Network Controller](https://junglewise.ai/threats/technologies/crosswork-network-controller), [Cisco Crosswork Planning](https://junglewise.ai/threats/technologies/crosswork-planning), [Cisco Crosswork Workflow Manager](https://junglewise.ai/threats/technologies/crosswork-workflow-manager), [Cisco Crosswork Data Gateway](https://junglewise.ai/threats/technologies/crosswork-data-gateway). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20359 being exploited in the wild.

**How severe is CVE-2026-20359?** Critical severity, with a CVSS score of 9.9, published 19 August 2026.

**Which products and versions are affected?** Cisco Crosswork Network Controller 7.2.1 and earlier; Cisco Crosswork Planning 7.2.1 and earlier; Cisco Crosswork Workflow Manager 2.1.1 and earlier; Cisco Crosswork Data Gateway 7.2.1 and earlier.

**Is there a fix for CVE-2026-20359?** A patch was published on 2026-08-19: Fixed releases available: Data Gateway/Network Controller/Planning 7.2.1-SP, Workflow Manager 2.1.1-SP Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20359 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-20359?** Check whether you run Cisco Crosswork Network Controller, Cisco Crosswork Planning, Cisco Crosswork Workflow Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This advisory addresses multiple hardening vulnerabilities in Cisco Crosswork, with CVE-2026-20359 specifically tracking insufficiently protected credentials (CWE-522). The vulnerabilities span multiple weakness categories including SQL injection (CWE-89), missing authentication (CWE-306), and external file system control (CWE-73), all reachable over the network without authentication required. These internally discovered vulnerabilities affect Crosswork Data Gateway, Network Controller, Planning, and Workflow Manager platforms. Patches are available in software versions 7.2.1-SP and 2.1.1-SP for the respective products; no workarounds exist.

## Affected products

- Cisco Crosswork Data Gateway 7.2.1 and earlier
- Cisco Crosswork Network Controller 7.2.1 and earlier
- Cisco Crosswork Planning 7.2.1 and earlier
- Cisco Crosswork Workflow Manager 2.1.1 and earlier

## Timeline

- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed releases available: Data Gateway/Network Controller/Planning 7.2.1-SP, Workflow Manager 2.1.1-SP

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-crosswork-UzDTU9Vh](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-crosswork-UzDTU9Vh)
- [https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification](https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification)

## Related threats

- [Cisco Crosswork external file system control vulnerability](https://junglewise.ai/threats/cve-2026-20358-cisco-crosswork-external-file-system-control-vulnerability)
- [Cisco Crosswork missing authentication for critical functions](https://junglewise.ai/threats/cve-2026-20357-cisco-crosswork-missing-authentication-for-critical-functions)
- [Cisco Crosswork SQL injection in multiple products](https://junglewise.ai/threats/cve-2026-20030-cisco-crosswork-sql-injection-in-multiple-products)
- [Cisco Crosswork Network Controller command injection in template engine](https://junglewise.ai/threats/cve-2026-20220-cisco-crosswork-network-controller-command-injection-in-template)
- [Cisco Crosswork Network Controller and NSO resource management issue](https://junglewise.ai/threats/cve-2026-20188-cisco-crosswork-network-controller-and-nso-resource-management)