Cisco patches 15 vulnerabilities across Crosswork, Secure Workload and BroadWorks
Cisco disclosed and patched 15 vulnerabilities on August 19, 2026: nine critical flaws in Crosswork and Secure Workload, a high severity BroadWorks XXE bug rated CVSS 7.5, and five medium severity issues elsewhere. The most urgent fixes are Crosswork 7.2.1 SP, Secure Workload 3.10.9.1 or 4.0.4.16, and BroadWorks RI....
Cisco disclosed and patched 15 vulnerabilities on August 19, 2026: nine critical flaws in Crosswork and Secure Workload, a high severity BroadWorks XXE bug rated CVSS 7.5, and five medium severity issues elsewhere.
The most urgent fixes are Crosswork 7.2.1 SP, Secure Workload 3.10.9.1 or 4.0.4.16, and BroadWorks RI.2026.07.
CVE 2026 20320 in BroadWorks allows an unauthenticated remote attacker to use crafted XML to read sensitive configuration information and accessible files.
What security vulnerabilities did Cisco disclose and patch on August 19, 2026, including the 15 flaws across its product portfolio, the BroaIllustration representing Cisco’s August 19, 2026 vulnerability fixes.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What security vulnerabilities did Cisco disclose and patch on August 19, 2026, including the 15 flaws across its product portfolio, the Broa. Article summary: Cisco disclosed 15 vulnerabilities on August 19, 2026: nine critical issues in Crosswork and Secure Workload, one high-severity BroadWorks XXE flaw, and five medium-severity flaws in Unified Intelligence Center, RoomOS, . Topic tags: general, education, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake nu
openai.com
Cisco’s August 19, 2026 security release covers 15 vulnerabilities across its product portfolio. The highest-priority issues affect Cisco Crosswork and Secure Workload, where several flaws carry CVSS scores of 10.0. The release also addresses an unauthenticated XML External Entity (XXE) vulnerability in BroadWorks and medium-severity issues in collaboration, contact-center and industrial-networking products.
Cisco said it was unaware of public announcements or malicious exploitation of the vulnerabilities when it published the advisories. It also listed no workaround for the affected products, making the specified software updates the primary remediation.
At a glance
15 vulnerabilities were disclosed and patched.
Nine are critical: four in Crosswork and five in Secure Workload.
BroadWorks CVE-2026-20320 is rated CVSS 7.5 and can be exploited remotely without authentication to read sensitive data.
Crosswork must be upgraded to 7.2.1-SP.
Secure Workload fixes are 3.10.9.1 for the 3.10 train and 4.0.4.16 for the 4.0 train.
No workaround was provided for the affected issues.
Four critical vulnerabilities in Cisco Crosswork
Cisco’s Crosswork security hardening release covers Crosswork Data Gateway, Crosswork Network Controller and Crosswork Planning releases 7.2.1 and earlier. Customers should upgrade to 7.2.1-SP.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "Cisco patches 15 vulnerabilities across Crosswork, Secure Workload and BroadWorks"?
Cisco disclosed and patched 15 vulnerabilities on August 19, 2026: nine critical flaws in Crosswork and Secure Workload, a high severity BroadWorks XXE bug rated CVSS 7.5, and five medium severity issues elsewhere.
What are the key points to validate first?
Cisco disclosed and patched 15 vulnerabilities on August 19, 2026: nine critical flaws in Crosswork and Secure Workload, a high severity BroadWorks XXE bug rated CVSS 7.5, and five medium severity issues elsewhere. The most urgent fixes are Crosswork 7.2.1 SP, Secure Workload 3.10.9.1 or 4.0.4.16, and BroadWorks RI.2026.07.
What should I do next in practice?
CVE 2026 20320 in BroadWorks allows an unauthenticated remote attacker to use crafted XML to read sensitive configuration information and accessible files.
The vulnerabilities were identified through Cisco’s internal testing, including testing involving frontier AI models, according to the advisory. Cisco reported no known malicious use and no workaround.
The combination of unauthenticated critical-function access, SQL injection, file-system control and credential exposure creates a particularly serious risk for organizations that expose affected management infrastructure or connect it to sensitive network systems. The CVSS ratings describe potential impact; they do not establish that these vulnerabilities have been exploited in the wild.
Five Secure Workload vulnerabilities require component updates
Cisco Secure Workload SaaS and on-premises deployments are affected. Cisco lists 3.10.9.1 as the fix for version 3.10 and earlier, and 4.0.4.16 for the 4.0 train. Customers must update all applicable Cluster, Agent and Connector components; Cisco says the SaaS Cluster has already been updated.
The five CVEs are:
CVE-2026-20231 — command, operating-system or argument injection, rated CVSS 9.9.
CVE-2026-20318 — improper input validation, including path-traversal and external-path-control classes, rated CVSS 9.6.
CVE-2026-20319 — buffer-overflow or out-of-bounds-write weakness, rated CVSS 7.5.
The last issue is high severity rather than critical; the other four Secure Workload CVEs are critical by their listed CVSS ratings. Cisco attributed the findings to its internal testing processes and reported no known exploitation or workaround.
CVE-2026-20320 affects the Open Client Interface XML parser in Cisco BroadWorks. It is a high-severity, unauthenticated remote blind XXE vulnerability with a CVSS score of 7.5. External-entity resolution is enabled by default, allowing a crafted message sent to the OCI-P service to expose sensitive configuration information and files accessible to the BroadWorks user.
Affected components include the:
BroadWorks Application Delivery Platform
BroadWorks Application Server
BroadWorks Profile Server
BroadWorks Xtended Services Platform
Releases before RI.2026.07 are affected, and Cisco identifies RI.2026.07 as the required fix. No workaround was provided. Cisco credited Sandesh M. Gawai with the discovery and said it was unaware of public exploitation at disclosure.
Because the flaw is unauthenticated and remotely reachable through the OCI-P service, BroadWorks operators should treat version verification and patch deployment as urgent, even though the available reporting does not establish active exploitation.
Five medium-severity vulnerabilities in other Cisco products
The remaining five vulnerabilities affect Unified Intelligence Center, RoomOS, Industrial Ethernet 1000 Series switches and Packaged Contact Center Enterprise.
Unified Intelligence Center: CVE-2026-20327
This authenticated, local blind SQL-injection vulnerability is rated CVSS 6.5. A valid user could use the web management interface to read data from the internal database. Cisco lists fixes in 12.6(2) ES08 and 15.0(1) SU2; releases earlier than 12.6 must migrate to a supported fixed release.
Cisco credited Hesham Ahmed of Spark Professional Services and listed no workaround or known malicious use.
RoomOS: CVE-2026-20302
The RoomOS USB-driver stack flaw is rated CVSS 6.1. Exploitation requires physical USB access but could allow arbitrary code execution with root privileges.
For on-premises operation, Cisco lists fixes 11.32.7.0 and 26.7.2.2. For cloud-aware operation, the listed fixes are 11.40.1.1 and 26.7.1.12. Cisco credited Jean-Michel Huguet of the NATO Cyber Security Centre and reported no known exploitation or workaround.
Industrial Ethernet 1000 switches
Both switch vulnerabilities are fixed in version 1.9.6. Releases before 1.9 must migrate to a fixed release.
CVE-2026-20232 is a stored cross-site scripting vulnerability rated CVSS 5.4. An authenticated remote user could inject script that executes in another user’s management-interface context. Cisco credited Rockwell Automation.
CVE-2026-20177 is a management-plane flooding denial-of-service vulnerability rated CVSS 5.3. An unauthenticated attacker could flood ICMP, SSH or HTTP traffic, making the graphical interface, SSH or API unavailable while data forwarding remains unaffected. Cisco identified this issue internally.
Cisco listed no workaround or known malicious use for either flaw.
Packaged CCE and Unified CCE: CVE-2026-20314
This authenticated remote Server-Side Request Forgery vulnerability is rated CVSS 5.0. Crafted HTTP requests could cause the affected server to originate arbitrary network requests. The fix is 15.0(1)ES202607; releases earlier than 15.0 must migrate to a fixed release.
Cisco credited Hesham Ahmed of Spark Professional Services, listed no workaround and reported no known exploitation.
What administrators should do now
Inventory affected products and versions. Check Crosswork, Secure Workload, BroadWorks, Unified Intelligence Center, RoomOS, Industrial Ethernet 1000 and CCE deployments against Cisco’s affected-version ranges.
Prioritize unauthenticated exposure. Crosswork’s critical vulnerabilities and BroadWorks CVE-2026-20320 do not depend on the same type of authenticated access required by several medium-severity findings.
Apply the product-specific fixed release. The principal targets are Crosswork 7.2.1-SP, Secure Workload 3.10.9.1 or 4.0.4.16, BroadWorks RI.2026.07, Unified Intelligence Center 12.6(2) ES08 or 15.0(1) SU2, Industrial Ethernet 1000 1.9.6, and CCE 15.0(1)ES202607. RoomOS administrators should use the fix matching their deployment model.
Update all required Secure Workload components. Cisco specifically calls out Cluster, Agent and Connector components for on-premises deployments.
Monitor for later exploitation intelligence. “No known exploitation” reflects Cisco’s position at disclosure and is not a guarantee that the vulnerabilities will remain unexploited.
The practical takeaway is straightforward: there are no listed workarounds, and the most consequential vulnerabilities affect products that may provide network management, workload-control or communications infrastructure. Organizations should verify their versions and schedule the applicable Cisco updates rather than relying on the absence of reported exploitation.
