← News
/DISPATCH · 2026-08-23

Cisco August Hardening Release: Crosswork and Secure Workload Total 9 Flaws, 5 Score CVSS 10.0

Cisco's August 2026 hardening release patches 9 vulnerabilities across Crosswork and Secure Workload, 5 of them CVSS 10.0. All issues were found by Cisco internal testing. No public exploit yet. Crosswork is a network-orchestration control plane; compromise affects every managed device. Upgrade immediately per vendor matrix to 7.2.1-SP / 3.10.9.1 / 4.0.4.16.

Incident Overview: Internal Security Review Surfaces 9 Control-Plane Defects

On 19 August 2026 Cisco published a hardening release for Crosswork and Secure Workload. On 21 August it added disclosure for Crosswork Workflow Manager. Total 9 vulns. Crosswork side: 4 (3x CVSS 10.0, 1x CVSS 9.9). Secure Workload side: 5 (2x CVSS 10.0, 2x CVSS 9.x, 1x CVSS 7.5). All found by Cisco PSIRT in internal security review. As of publication: no confirmed in-the-wild exploit, no public PoC, no bypass.

Crosswork is Cisco's network automation and orchestration suite; it pushes config to routers, switches, controllers. Secure Workload is the microsegmentation and workload-security platform. Both sit on the enterprise control plane and policy-management plane, not ordinary workloads. Loss of either is not a single-system event: the attacker can rewrite the whole network infrastructure. Five CVSS 10.0 vulns landing together on control-plane and policy-management products is an internal-review signal that needs serious treatment.

Vulnerability Detail and Impact Surface

Crosswork 4 Vulns (CVSS 10.0, 10.0, 10.0, 9.9)

Secure Workload 5 Vulns (CVSS 10.0, 10.0, 9.9, 9.6, 7.5)

Technical Details: What Five 10.0 Scores Landing Together Means

Five concurrent CVSS 10.0 scores mean: each exploit needs no privileges, no user interaction, is reachable over the network, and fully breaks confidentiality, integrity, and availability. Last comparable density was roughly the 2024-2025 storage-system disclosure wave. Abnormal signal. Cisco publicly framed this as internal hardening, not a routine advisory—i.e. a deliberate special-review result.

Type distribution: the CVSS 10.0 cluster is SQL injection, missing auth on critical functions, external filesystem control, broken access control, broken authentication. The first three have sat at the top of OWASP Top 10 for ~20 years; the last two are common in enterprise intranet SSO and RBAC. Hitting all five at once means Crosswork and Secure Workload have systemic defects across authn, authz, and input validation—not one-off bugs.

Impact Assessment: Why Control-Plane 9.6 Equals Business-Plane 10.0

CVSS does not extra-weight the control plane. On a normal business system, a CVSS 9.6 input-validation issue may mean one abused API. On an orchestration system it means the attacker can rewrite the entire network intent—pushing malicious change down a legitimate channel, visually indistinguishable from a normal change. Any Crosswork Workflow Manager state change docks to managed network devices. Security outcome equals the operator voluntarily calling an attacker-configured API.

For operators, this disclosure sits on the same strategic arc as earlier Catalyst SD-WAN and ASA/FTD vulns exploited in the wild: Cisco gear is being hunted systematically because it covers nearly every large enterprise network worldwide. No known exploit yet, but an internal review finding 5x CVSS 10.0 means patch day is a research start line for attackers. High-severity enterprise vulns now go from disclosure to working PoC in days. Finish the upgrade inside that window.

Remediation and Defense

Patch Now

Hardening and Change Management

Even with Cisco stating not known to be exploited, attacker attention on Cisco gear plus control-plane defect density means any org running Crosswork / Secure Workload upgrades now. Do not treat management-plane hardening as a substitute for the business patch.

References