Six CVSS 10.0 Flaws in Cisco Crosswork and Secure Workload: What Defenders Need to Know

As reported by SecurityAffairs, Cisco has disclosed a batch of nine critical vulnerabilities — six of them carrying a perfect CVSS 10.0 score — across its Crosswork infrastructure management platform and Secure Workload software. These were discovered during an internal security review, not in response to active exploitation, which is a notable positive signal. But the severity and breadth of the issues warrant serious attention from any organization running these products.

Why This Matters

Seeing three CVSS 10.0 vulnerabilities in a single Cisco advisory is exceptional. These aren't edge-case bugs requiring exotic conditions — they include SQL injection, missing authentication for critical functions, and external control of file systems. Each represents a potential full-compromise path for an attacker with network access to the affected service.

The fact that Cisco grouped vulnerabilities by CWE class and assigned single CVE identifiers per grouping is architecturally interesting. It suggests the underlying codebases had systemic weaknesses in multiple locations rather than isolated one-off mistakes. For defenders, this means the patch addresses a class of problem — but it also raises questions about whether similar patterns exist in adjacent Cisco products not covered by this review.

Vulnerability Summary

Affected Versions and Patch Status

The combination of SQL injection, missing authentication, and credential exposure in Crosswork means an unauthenticated attacker on the management network could potentially pivot from initial access to full platform compromise without needing valid credentials.

Who Is Most Exposed

Cisco Crosswork is used by large telecommunications providers and enterprises managing complex network infrastructure. Secure Workload (formerly Tetration) is deployed for microsegmentation and workload protection in data centers. The most exposed organizations are:

• Telecoms and ISPs running Crosswork for network orchestration
• Enterprises with Crosswork exposed on management networks reachable beyond trusted segments
• Organizations running Secure Workload on-premises where the appliance interface is accessible to broad internal ranges
• Environments where patching cadence for infrastructure management tools lags behind endpoint and server patching

Shield53 Recommendations

Immediate Actions

• Patch Crosswork to 7.2.1-SP immediately if running 7.2.1 or earlier. This is the single most important step — three CVSS 10.0 flaws in one platform is a rare and severe combination.
• Apply Secure Workload patches for both SaaS and on-prem deployments. For SaaS, confirm with Cisco that your tenant has been updated.
• Restrict network access to Crosswork and Secure Workload management interfaces using ACLs or firewall rules. These platforms should never be reachable from user networks or the internet.
• Audit credential stores on affected Crosswork systems post-patch. Given CVE-2026-20359 involves insufficiently protected credentials, rotate any service account or API keys that were stored on these systems.
• Review access logs for anomalous activity on Crosswork and Secure Workload interfaces, focusing on unauthenticated requests, unexpected SQL query patterns, and file system access anomalies. Even without known exploitation, verify your environment is clean.

Strategic Considerations

• Treat infrastructure management platforms as Tier-0 assets — they sit at the top of your trust hierarchy and deserve the same hardening as domain controllers and identity providers.
• Ask whether your vendor's internal security review program extends to all products in your stack. Cisco's proactive approach here is commendable, but it also reveals that these platforms had systemic weaknesses that survived prior testing cycles.