CVE-2026-20359 addresses insufficiently protected credentials in Cisco Crosswork Planning, classified under CWE-522. This vulnerability was discovered internally by Cisco and affects several specific versions of the product. The CVSS 3.1 base score of 9.9 reflects critical severity with network attack vector, low attack complexity, privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not yet published an official fix or remediation guidance. The affected versions explicitly include 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2, and 7.2.0.

The vulnerability allows attackers with some privileges to potentially access or compromise sensitive credentials, leading to a complete loss of confidentiality, integrity, and availability of the affected system. This could enable unauthorized access, data manipulation, or service disruption within Cisco Crosswork Planning environments running the affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Cisco's advisories for updates. Until a patch is available, limit access to affected systems to trusted users with minimal privileges and follow Cisco's security best practices for credential management.