# Cisco Crosswork: apply the security release for each platform Canonical: https://www.oktsec.com/radar/cisco-crosswork-august-2026-security-hardening Publisher: Oktsec Language: en Published: 2026-11-14T16:00:33Z Updated: 2026-11-14T16:00:33Z Record reviewed: 2026-11-14T16:00:33Z Latest evidence check: 2026-11-14T16:00:33Z Disclosed: 2026-08-19 Cisco provides security releases for four Crosswork platforms, regardless of configuration. Its August advisory groups multiple issues under four CVEs and does not report malicious use. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Cisco rates these grouped flaws critical and provides fixes. The vendor does not report exploitation; prioritize affected deployments without presenting the August disclosure as a new attack. - Evidence: No attacks reported - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Cisco - Products: Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning, Crosswork Workflow Manager - CVEs: CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, CVE-2026-20359 ## Technical overview This is an August 19 disclosure, expanded on August 21 to include Workflow Manager. Its appearance in a later regional notice does not make it a new November incident. The CVEs group issues involving SQL commands, missing authentication, file paths and credential protection. Cisco provides no workaround. Its broad platform table and the narrower CNA records serve different purposes; use the platform table to plan updates. ## Recommended response Install the corrected release for each Crosswork platform. Check Workflow Manager separately; its release numbering differs from the other products. Relevant to: Administrators of Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning, Crosswork Workflow Manager. ## CVE attribution - CVE-2026-20030: Cisco — Cisco Crosswork Planning. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20030.json) - CVE-2026-20357: Cisco — Cisco Crosswork Planning. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20357.json) - CVE-2026-20358: Cisco — Cisco Crosswork Planning. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20358.json) - CVE-2026-20359: Cisco — Cisco Crosswork Planning. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20359.json) ## Affected systems and fixes ### Crosswork Data Gateway Affected: 7.2.1 and earlier Fixed release / action: 7.2.1-SP ### Crosswork Network Controller Affected: 7.2.1 and earlier Fixed release / action: 7.2.1-SP ### Crosswork Planning Affected: 7.2.1 and earlier Fixed release / action: 7.2.1-SP ### Crosswork Workflow Manager Affected: 2.1.1 and earlier Fixed release / action: 2.1.1-SP Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-20359](https://api.first.org/data/v1/epss?cve=CVE-2026-20359): 0.42% probability of observed exploitation in the next 30 days; percentile 37.23%; score date 2026-11-14. - [CVE-2026-20358](https://api.first.org/data/v1/epss?cve=CVE-2026-20358): 0.48% probability of observed exploitation in the next 30 days; percentile 42%; score date 2026-11-14. - [CVE-2026-20357](https://api.first.org/data/v1/epss?cve=CVE-2026-20357): 0.62% probability of observed exploitation in the next 30 days; percentile 50.06%; score date 2026-11-14. - [CVE-2026-20030](https://api.first.org/data/v1/epss?cve=CVE-2026-20030): 0.57% probability of observed exploitation in the next 30 days; percentile 47.91%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ### Official regional advisories - [Vulnerabilidades en productos Cisco](https://www.cert.gov.py/vulnerabilidades-en-productos-cisco-19/) — CERT-PY, Paraguay; publication 2026-11-12T13:14:50.000Z; observed 2026-11-14T21:07:37.491Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Inventory each platform** — Identify the installed Crosswork products and releases. 2. **Apply the correct release** — Use 7.2.1-SP for Data Gateway, Network Controller and Planning; use 2.1.1-SP for Workflow Manager, or a later corrected release. 3. **Verify the deployment** — Oktsec recommends checking the running version and restricting management access while arranging the update. ## Relevance to AI environments Verify the software and permissions behind automated operations. ## Sources - [Affected products, fixed releases and exploitation status](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-crosswork-UzDTU9Vh) — Cisco; Vendor notice; checked 2026-11-14T16:00:33Z - [CNA product scope for CVE-2026-20030](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20030.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z - [CNA product scope for CVE-2026-20357](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20357.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z - [CNA product scope for CVE-2026-20358](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20358.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z - [CNA product scope for CVE-2026-20359](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20359.json) — Cisco (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z ## Editorial record - 2026-11-14T16:00:33Z: Added affected scope, verified corrections and limits of the available evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/cisco-crosswork-august-2026-security-hardening) · [Build a response plan](https://www.oktsec.com/radar/cisco-crosswork-august-2026-security-hardening#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-crosswork-august-2026-security-hardening&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-crosswork-august-2026-security-hardening&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.