Cisco Crosswork Planning contains a vulnerability identified as CVE-2026-20358, related to external control of file name or path (CWE-73). This flaw allows an attacker to manipulate file system paths, which can lead to high impact on system integrity and availability. The vulnerability affects multiple specific versions of Cisco Crosswork Planning (7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2, and 7.2.0). The CVSS v3.1 score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. Cisco has not yet published an official remediation or patch for this vulnerability.

The vulnerability allows an unauthenticated attacker to externally control file names or paths in Cisco Crosswork Planning, potentially leading to high integrity and availability impacts. This could enable modification or disruption of critical files or processes. Confidentiality impact is not indicated. The vulnerability is rated critical with a CVSS score of 10.0. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Cisco has released a software hardening update addressing multiple vulnerabilities including this one, but no specific patch or fix version is currently documented. Until an official fix is available, monitor Cisco advisories for updates.