A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
CVE-2026-20327 is a medium severity SQL injection vulnerability in the web-based management interface of Cisco Unified Intelligence Center. It allows an authenticated local attacker to perform blind SQL injection by sending crafted requests, potentially reading the internal database contents. Exploitation requires valid user credentials. No patch information is provided in the input data.
A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.
This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20319 are related to buffer management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-119.
CVE-2026-20315 is a critical improper access control vulnerability in Cisco Secure Workload. It was discovered during an internal security review and affects multiple specific versions of the product. The vulnerability is classified under CWE-284 and has a CVSS 3.1 base score of 10.0, indicating it allows unauthenticated attackers to fully compromise confidentiality, integrity, and availability without user interaction. No information about available patches or vendor advisories is provided in the input.
CVE-2026-20317 is a critical improper authentication vulnerability in Cisco Secure Workload. It was discovered during an internal security review by Cisco's engineering team and is related to CWE-287. The vulnerability affects multiple specific versions of Cisco Secure Workload. The CVSS score is 10.0, indicating a critical severity with network attack vector, low complexity, no privileges required, no user interaction, and impacts integrity and availability with scope changed. There is no explicit vendor advisory or patch information provided in the input.
CVE-2026-20318 is a critical vulnerability in Cisco Secure Workload involving improper input validation. This issue was identified during an internal security review by Cisco and affects multiple specific versions of the product. The vulnerability has a high CVSS score of 9.6, indicating critical severity with high impact on integrity and availability. No known exploits are reported in the wild. The vulnerability is addressed by a software hardening release from Cisco.
CVE-2026-20359 is a critical vulnerability in Cisco Crosswork Planning involving insufficiently protected credentials. The issue relates to improper protection of credentials, categorized under CWE-522. Cisco addressed this vulnerability as part of a software hardening release following an internal security review. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. Multiple specific versions of Cisco Crosswork Planning are affected. There is no indication of known exploits in the wild or cloud service involvement.
CVE-2026-20358 is a critical vulnerability in Cisco Crosswork Planning involving external control of file name or path. It was discovered during an internal security review and relates to CWE-73, which concerns external control of file system resources. The vulnerability affects multiple specific versions of Cisco Crosswork Planning. The CVSS score is 10.0, indicating a critical severity with no required privileges or user interaction, and it impacts integrity and availability. No known exploits are reported in the wild. Cisco has released a software hardening update addressing these issues.
CVE-2026-20357 is a critical vulnerability in Cisco Crosswork Planning involving missing authentication for critical functions. This flaw allows unauthenticated remote attackers to potentially execute actions with high impact on confidentiality, integrity, and availability. The vulnerability affects multiple specific versions of Cisco Crosswork Planning. Cisco has acknowledged the issue as part of an internal security review and released a software hardening update addressing multiple vulnerabilities including this one.
CVE-2026-20302 is a buffer overflow vulnerability in the USB driver of Cisco RoomOS software. It allows an unauthenticated local attacker with physical access to the USB port to execute arbitrary code with root privileges by connecting a malicious USB device. The flaw arises from insufficient boundary checks on data provided through the USB driver.
A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of another user. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.
CVE-2026-20231 is a critical vulnerability in Cisco Secure Workload involving improper neutralization of special elements in output used by a downstream component, categorized under CWE-74. This vulnerability has a CVSS score of 9.9, indicating high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. It impacts confidentiality, integrity, and availability with a complete scope change. Multiple specific versions of Cisco Secure Workload are affected.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20030 are related to improper neutralization of special elements used in a SQL command issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.
CVE-2026-20177 is a medium severity vulnerability in Cisco Industrial Ethernet 1000 Series Switches. It involves insufficient protection against management plane flooding attacks, allowing an unauthenticated remote attacker to cause denial of service by overwhelming the device manager, SSH, or API. The vulnerability does not affect data traffic through the device. Multiple specific firmware versions are affected.
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device.
This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
A vulnerability in the GPT file format parser of ClamAV allows an unauthenticated remote attacker to cause a denial-of-service (DoS) condition due to improper handling of endian conversion leading to an out-of-bounds buffer write. Exploitation involves submitting a crafted GPT file to ClamAV for scanning, which may cause the scanning process to terminate unexpectedly.