Cisco has patched nine vulnerabilities across its Crosswork and Secure Workload platforms, five of them rated the maximum CVSS 10.0, including CVE-2026-20357, a missing-authentication flaw in Crosswork that an unauthenticated attacker could use to take over the orchestration plane. Cisco found the issues through internal security testing rather than in-the-wild exploitation, and there are no reports of active attacks. But because these products sit at the control center of network and workload segmentation, a maximum-severity bug on the orchestrator effectively bypasses the very controls it manages, which is why Cisco and defenders are treating patching as urgent.

The CVSS 10.0 set spans both products and several weakness classes. In Cisco Crosswork, CVE-2026-20357 is a missing-authentication issue (CWE-306) and CVE-2026-20358 involves external control of a file path (CWE-73). In Secure Workload, CVE-2026-20315 is an improper-access-control flaw (CWE-284) and CVE-2026-20317 is an improper-authentication flaw (CWE-287), with additional high-severity input-validation and out-of-bounds-write bugs rounding out the advisory. All of them share a theme: unauthenticated or under-authenticated access to a platform that holds broad visibility and control over the data fabric.

That is the point the security community keeps making, sometimes called the central-controller paradox. Zero-trust and micro-segmentation platforms like Secure Workload and Crosswork are designed to hold "god mode" over the environment, so a pre-authentication compromise of the controller pivots straight past every segmentation policy underneath it. The relief this time is that Cisco's own hardening review caught the flaws before a nation-state actor did, a welcome contrast to recent edge-device campaigns discovered only in telemetry.

Which Cisco products and versions are affected, and what are the fixes?

The advisory covers Cisco Crosswork and Cisco Secure Workload. There are no workarounds; upgrading is the only remediation. Cisco Crosswork is fixed in release 7.2.1-SP, and Cisco Secure Workload is fixed in 3.10.9.1 and 4.0.4.16. Cloud-hosted Secure Workload clusters were updated by Cisco, but on-premises agents and connectors still need to be verified and patched.

Fixed builds: Crosswork 7.2.1-SP; Secure Workload 3.10.9.1 and 4.0.4.16.

Are these Cisco flaws being exploited?

Not according to Cisco. The company states the vulnerabilities were identified during internal testing and it is not aware of active exploitation. That status can change quickly once patch diffs are public, so the practical guidance is to confirm your management interfaces are not reachable from untrusted zones and to hunt your reverse-proxy and API logs for anomalous requests against the Crosswork and Secure Workload endpoints before and after patching.

Our read

A CVSS 10.0 on the segmentation controller is the cleanest illustration of why "understand your risk" has to start with the crown jewels, not the perimeter. These appliances are supposed to live on isolated management networks, but the recurring finding in real assessments is that a jump host or a misconfigured bridge quietly connects them to routable subnets. The verifiable-by-design step is to prove the isolation, not assume it: enumerate exactly what can reach these management planes, test that path the way an attacker would, and patch to Crosswork 7.2.1-SP and Secure Workload 3.10.9.1 or 4.0.4.16 without waiting for exploitation to make the decision for you.

Reporting by The Hacker News; CVSS and CWE data per NVD and Cisco's advisories. Sources linked above.

Related: Cisco Catalyst SD-WAN CVE-2026-20303 and NetScaler CVE-2026-19490 authentication bypass.