CVE-2026-20359

CVE-2026-20359 is an insufficiently protected credentials flaw (CWE-522) in Cisco Crosswork, discovered by Cisco's own Crosswork engineering team during a comprehensive internal security review and addressed in a software hardening release. Because the CVSS vector shows the issue is network-exploitable (AV:N) with low attack complexity and only low privileges required (PR:L), an attacker with limited access to the system could obtain or abuse credentials that are not adequately protected, gaining access that could affect confidentiality, integrity, and availability beyond the vulnerable component itself (scope changed, high impact across C/I/A). Affected organizations are those running Cisco Crosswork deployments, which are typically operated by service providers and large enterprises for network automation and management. As of now there is no evidence of exploitation in the wild, no public proof-of-concept, and the flaw is not in CISA's KEV catalog, with EPSS assigning only a 0.4% probability of exploitation in the next 30 days. The flaw was disclosed as part of a batch of nine internally discovered Crosswork and Secure Workload vulnerabilities published around Cisco's August 19, 2026 advisory release.

What to do: Check Cisco's August 19, 2026 Crosswork security advisories and upgrade affected Crosswork deployments to the software hardening release that addresses CVE-2026-20359. Until patching, restrict network access to the Crosswork management interfaces, limit low-privileged accounts, and rotate credentials that could be exposed through the platform. Since disclosure is part of a larger batch of nine Crosswork and Secure Workload fixes (five at CVSS 10.0), review all related advisories rather than this CVE alone.