External risk intelligence

Cisco Crosswork External Control of File System Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-20358

Cisco Crosswork is typically deployed as a network management and orchestration platform. While these systems are usually restricted to internal management networks and not directly exposed to the public internet, they are plausibly reachable in some complex or misconfigured network environments.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights vulnerabilities in Cisco Crosswork, a network management technology, that could allow external parties to manipulate files on the system. While the exact impact depends on your specific deployment and network configuration, such issues can fundamentally compromise system integrity and operational control. The primary concern is to confirm whether your Cisco Crosswork environment is exposed and, if so, to understand the specific exposure.

External control over system files.
Potential for system compromise.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the Cisco Crosswork platform by exploiting a vulnerability that allows them to control the file system. This could occur if the platform is exposed externally, either through direct internet access or misconfiguration, allowing an unauthenticated attacker to manipulate files on the system. Successful exploitation could lead to significant impacts on the system's integrity and availability.

No authentication required for access.
External control of the file system.
Potential for integrity and availability loss.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, external control of the file system could allow an unauthenticated attacker to impact the availability and integrity of the Cisco Crosswork system by leveraging vulnerabilities related to external control of the file system. This could potentially affect the overall behavior and functionality of the network management and orchestration platform.

System integrity and availability.
External control of file system.
Disruption of network management.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, related to external control of the file system, likely impacts network infrastructure and operations teams responsible for Cisco Crosswork platforms. The initial priority should be to identify all instances of the affected technology within the environment, assess their reachability and criticality, and confirm the accountable system owner before planning remediation activities.

Network and Platform teams own this issue.
Verify affected Crosswork instance reachability.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco Crosswork?

Cisco Crosswork is a software platform designed for network management and orchestration. It acts as a centralized brain for service providers and large enterprises to automate, monitor, and optimize complex network infrastructure. By managing configurations and operational data across the network, it serves as a critical component for maintaining consistent service delivery and operational efficiency.

What does CVE-2026-20358 mean?

This CVE refers to a vulnerability classified as CWE-73, or External Control of File Name or Path. In plain terms, it means the software does not properly validate or restrict user-supplied input when accessing files. An attacker could potentially trick the system into reading or writing files in unintended locations, which can disrupt system integrity or cause the software to behave in ways not intended by the developers.

How does an attacker trigger this bug?

The vulnerability is triggered when an attacker sends specifically crafted network requests to the affected system that manipulate file paths. Importantly, this does not require a legitimate user to perform any action or provide authentication credentials to the system. If the software is functioning within its normal, secure parameters and is not receiving these malicious inputs, the file system remains protected.

Is my Cisco Crosswork instance at risk?

Halo Surface Signal indicates that while Cisco Crosswork is generally deployed on protected, internal management networks, it may be reachable in complex or misconfigured environments. If your instance is directly accessible via the public internet, it faces a higher level of risk. You should evaluate your network architecture to determine if the platform is exposed outside of your secure management zones.

Do I need to take immediate action?

Yes. Start by inventorying all Cisco Crosswork instances in your environment to understand which ones are active. Consult the official Cisco security advisory linked in the catalog to identify the specific software hardening release required for your deployment. Work with your platform and network teams to confirm the reachability of these systems and schedule the necessary updates to secure your infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.