Threat Intelligence Database

CVE-2026-20359 is a critical vulnerability in Cisco Crosswork Planning involving insufficiently protected credentials. The issue relates to improper protection of credentials, categorized under CWE-522. Cisco addressed this vulnerability as part of a software hardening release following an internal security review. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. Multiple specific versions of Cisco Crosswork Planning are affected. There is no indication of known exploits in the wild or cloud service involvement.

CVE-2026-20358 is a critical vulnerability in Cisco Crosswork Planning involving external control of file name or path. It was discovered during an internal security review and relates to CWE-73, which concerns external control of file system resources. The vulnerability affects multiple specific versions of Cisco Crosswork Planning. The CVSS score is 10.0, indicating a critical severity with no required privileges or user interaction, and it impacts integrity and availability. No known exploits are reported in the wild. Cisco has released a software hardening update addressing these issues.

CVE-2026-20357 is a critical vulnerability in Cisco Crosswork Planning involving missing authentication for critical functions. This flaw allows unauthenticated remote attackers to potentially execute actions with high impact on confidentiality, integrity, and availability. The vulnerability affects multiple specific versions of Cisco Crosswork Planning. Cisco has acknowledged the issue as part of an internal security review and released a software hardening update addressing multiple vulnerabilities including this one.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20030 are related to improper neutralization of special elements used in a SQL command issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.