External risk intelligence

Cisco Crosswork Missing Authentication for Critical Functions Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-20357

Cisco Crosswork is a network automation and management platform typically deployed within internal service provider or enterprise network operations centers. While these systems are complex and may have specific interfaces exposed to managed network elements or integrated systems, they are not standard public-facing internet services by design.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses vulnerabilities discovered internally within Cisco Crosswork software, related to missing authentication for critical functions. While the specific impact is still under review, issues like these could potentially allow unauthorized access or control if they are exposed and exploited. The primary concern is to confirm if your environment utilizes this technology and assess any potential exposure.

Missing authentication for critical functions.
Leadership should remember for potential access risks.
Confirm relevance and potential exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach a critical function within Cisco Crosswork because authentication is missing. This exposure allows an unauthenticated attacker to remotely trigger the vulnerability, potentially leading to significant impacts on confidentiality, integrity, and availability of the system.

No authentication is required.
A network-accessible critical function can be triggered.
Results in high impact on confidentiality, integrity, and availability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to impact the availability or integrity of the Cisco Crosswork system, potentially affecting its ability to manage and automate network functions. The specific impact depends on the functions that are vulnerable when supported by the advisory.

System availability and integrity.
Unauthenticated remote access to critical functions.
Disruption of network management services.

Operational Fix

Recommended remediation, mitigation, and detection steps

Cisco Crosswork's missing authentication vulnerabilities likely fall under the responsibility of the platform or infrastructure teams managing the Cisco Crosswork environment. The first practical step is to identify all deployed instances of Cisco Crosswork, assess their business criticality and external reachability, and then assign ownership for remediation planning.

Platform or infrastructure teams own the issue.
Verify Cisco Crosswork instance exposure and criticality.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco Crosswork?

Cisco Crosswork is a specialized software platform used by service providers and enterprises to automate and manage complex network operations. It acts as a centralized brain for orchestrating various network functions, allowing administrators to monitor performance and deploy configurations across their infrastructure from a single management console.

What does CVE-2026-20357 mean by missing authentication?

This vulnerability relates to CWE-306, which occurs when a software system fails to verify the identity of a user before performing a sensitive action. In this case, certain critical functions within Cisco Crosswork do not require a login, potentially allowing unauthorized parties to interact with features that should be strictly restricted to authenticated administrators.

How can an attacker trigger this vulnerability?

An attacker triggers this by reaching a network-accessible, critical function within the Cisco Crosswork platform. Because the system lacks proper authentication checks for these specific tasks, no login credentials are required to initiate them. The vulnerability is not triggered by actions that occur within secure, local-only management sessions where the critical functions remain isolated from the broader network.

Is my Cisco Crosswork deployment at risk?

While Halo Surface Signal classifies this CVE as having an external network attack vector, Cisco Crosswork is typically deployed within internal network operations centers rather than as a public-facing service. You should evaluate if your specific instance has any interfaces reachable from outside your trusted network perimeter, as those are the primary areas of concern.

What should I do if I run Cisco Crosswork?

The first step is to inventory all deployed instances of Cisco Crosswork within your environment. Once identified, your infrastructure team should assess the network reachability of these instances and determine their business criticality. Coordinate with your team to review vendor guidance and plan the necessary software updates to harden these systems against unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.