CVE-2026-20357 describes missing authentication for critical functions in Cisco Crosswork Planning, categorized under CWE-306. This vulnerability permits unauthenticated remote attackers to perform unauthorized actions, leading to complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no privileges required, no user interaction, and scope change. The affected versions explicitly include 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2, and 7.2.0. Cisco identified this vulnerability during an internal security review and issued a software hardening release to address it and other issues.

Successful exploitation of this vulnerability allows unauthenticated remote attackers to invoke critical functions without authentication, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized data access, modification, and disruption of service.

Cisco has released a software hardening update that addresses this vulnerability as part of a broader security review. Users should apply the official Cisco updates corresponding to their affected versions to remediate this issue. Since this is not a cloud service, remediation depends on applying these patches. Patch status is confirmed by Cisco's advisory of a hardening release.