On Wednesday, Cisco announced the release of patches addressing 15 security vulnerabilities across its product range. Among these, significant flaws in Crosswork and Secure Workload products were identified as critical, posing high potential risks to users.
Key Updates in Crosswork Security
The recent update labeled Crosswork version 7.2.1-SP has been launched to fix four critical security vulnerabilities, identified by CVEs CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, and CVE-2026-20359. The first three flaws received a perfect severity score of 10 out of 10, indicating severe risks, while the fourth was rated at 9.9.
Cisco explained that these vulnerabilities include SQL injection, missing authentication, and external control of file systems, while the last one involves weak credential protection. Exploitation could lead to remote code execution, authentication bypass, and unauthorized file manipulation.
Secure Workload Vulnerabilities Addressed
In a parallel move, Cisco released Secure Workload versions 4.0.4.16 and 3.10.9.1, rectifying five critical vulnerabilities. These issues, tracked under CVEs such as CVE-2026-20315 and CVE-2026-20317, involved improper access control and authentication flaws. Other critical concerns included code injections and input validation errors.
Additionally, a flaw involving buffer overflows and out-of-bounds write issues was patched, known as CVE-2026-20319. These updates aim to prevent unauthorized system access and potential data breaches.
Additional Vulnerabilities and Resolutions
Cisco also addressed a high-severity flaw in the BroadWorks Open Client Interface XML parser, tracked as CVE-2026-20320. This defect could allow remote attackers to access sensitive data without authentication due to external entity resolution being enabled by default.
The resolution involved updates to various BroadWorks platforms, including the BroadWorks Application Delivery Platform and Profile Server. Moreover, medium-severity vulnerabilities in products such as Unified Intelligence Center and RoomOS were also resolved.
Importantly, Cisco reported no known exploitation of these vulnerabilities in the wild. For more detailed information, Cisco recommends consulting their security advisories page.
Cisco’s proactive measures highlight its commitment to safeguarding its network solutions, emphasizing the importance of timely software updates to prevent cyber threats. Users are encouraged to apply these updates immediately to enhance their security posture.
