Cisco just found five perfect-10 bugs in its own network tools — before anyone else did

Cisco shipped patches on August 20, 2026, for nine separate vulnerabilities across two of its network-management platforms — Crosswork and Secure Workload — and five of them score a perfect 10.0 on the CVSS scale, the highest severity rating that exists. Nobody's reported active exploitation yet, and Cisco says its own internal testing caught these bugs before an outside researcher or an attacker did, according to The Hacker News. That's the good version of this story. Here's the part that should still worry you: Crosswork and Secure Workload aren't peripheral apps. They're the software that maps your network topology and enforces microsegmentation policy across your data center. A hole in the tool that secures your workloads is worse than a hole in an ordinary app, because it sits with elevated trust across everything it touches.

The nine bugs, in plain terms

Four of the flaws hit Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning — and Cisco's own advisory notes they apply regardless of how the device is configured, which is the phrase you don't want to see in a security bulletin. CVE-2026-20030 is a SQL injection bug. CVE-2026-20357 is missing authentication for a critical function. CVE-2026-20358 lets an attacker exercise external control over the file system. All three score a flat 10.0. A fourth, CVE-2026-20359, covers insufficiently protected credentials at 9.9. Cisco shipped Crosswork 7.2.1-SP with fixes for all four.

The other five sit in Secure Workload, the product literally named for enforcing security policy on workloads. CVE-2026-20315 and CVE-2026-20317 — improper access control and improper authentication, respectively — both hit 10.0. A third, command and OS argument injection tracked as CVE-2026-20231, scores 9.9. Two more round out the set at 9.6 and 7.5, covering path traversal and a buffer overflow. Fixes landed in Secure Workload 4.0.4.16 for the 4.0 branch and 3.10.9.1 for 3.10 and earlier.

Why Crosswork's combo is the scarier half

A single 10.0 bug is bad. Three of them stacked on the same product, one of which removes the authentication requirement entirely, is a different category of bad. Pair CVE-2026-20357 (missing authentication for a critical function) with CVE-2026-20358 (external control of the file system) and an attacker doesn't need a stolen password or a phished session token — just network reach to the management interface. That's the scenario every enterprise security team is supposed to design against, and it's exactly the scenario these two CVEs create together.

This isn't Secure Workload's first maximum-severity bug this year

In May 2026, Cisco patched a separate CVSS 10.0 flaw in Secure Workload's REST API that let an attacker pull data out of the platform, reported at the time by The Hacker News. Two maximum-severity disclosures in the same product inside four months isn't proof of a systemic problem on its own, but it's the kind of pattern that should shape how you prioritize patching — not just this batch, but the next one. We've tracked the same story shape elsewhere this year too: Cisco's ASA/FTD firewall flaw and a root-access proof-of-concept against Cisco IMC both moved from disclosure to real-world attention fast. Management-plane software from other vendors hasn't fared better either — VMware's vCenter reverse-SSH bug and Exchange Server's Pwn2Own mailbox-takeover chain both broke this same season.

Cisco getting to nine of these bugs before an outsider did is genuinely the best-case version of a disclosure like this. But best-case doesn't mean low-priority. If your organization runs Crosswork or Secure Workload anywhere in the stack, patch this week, not this quarter — the gap between a Cisco patch Tuesday and a CISA known-exploited listing has been shrinking all year, and there's no reason to assume this batch will be the exception.