CVE-2026-20358 concerns vulnerabilities in Cisco Crosswork Planning that allow external control over file names or paths, categorized under CWE-73. These vulnerabilities were identified through Cisco's internal security review and addressed in a software hardening release. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high impact on integrity and availability. The affected versions include 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2, and 7.2.0.

The vulnerability allows an unauthenticated attacker to externally control file names or paths in Cisco Crosswork Planning, potentially leading to high integrity and availability impacts. This could enable unauthorized modification or disruption of system files or processes. The CVSS score of 10.0 indicates critical severity with a network attack vector and no required privileges or user interaction.

Cisco has released a software hardening update that addresses these vulnerabilities. Users should apply the official patches or updates provided by Cisco for the affected versions. Since this is not a cloud service, remediation requires updating the affected software installations. No known exploits are currently reported in the wild.