CVE-2026-20358: Cisco Crosswork Path Traversal Flaw

CVE-2026-20358 Overview

CVE-2026-20358 is a vulnerability in Cisco Crosswork identified during an internal security review conducted by the Cisco Crosswork engineering team. The issue is categorized under [CWE-73], external control of file name or path. An unauthenticated remote attacker can influence file system paths used by the application, leading to integrity and availability impact across a changed security scope. Cisco addressed the flaw as part of a software hardening release that resolved multiple internally discovered issues.

Critical Impact
Remote, unauthenticated attackers can manipulate file system paths in Cisco Crosswork to modify or destroy files, disrupt service operations, and pivot across trust boundaries.

Affected Products

Cisco Crosswork (see the Cisco Security Advisory for the fixed release train)
Deployments running pre-hardening Crosswork builds
Systems exposing Crosswork management interfaces to untrusted networks

Discovery Timeline

2026-08-19 - CVE-2026-20358 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-20358

Vulnerability Analysis

CVE-2026-20358 stems from external control of file system paths within Cisco Crosswork components. The application accepts attacker-influenced path or filename input and uses it in privileged file system operations without adequate validation. Because the flaw crosses a security boundary, exploitation affects components beyond the vulnerable module itself.

Successful exploitation lets an attacker cause file modification, deletion, or replacement on the target host. This impacts integrity of Crosswork configuration and operational data and can render orchestration services unavailable. The network-reachable attack surface and lack of authentication requirements make exploitation feasible from remote positions with no user interaction.

Root Cause

The underlying weakness is [CWE-73]: External Control of File Name or Path. Crosswork accepted externally supplied values that were used to construct file system references. Insufficient canonicalization and missing allow-list controls permitted attackers to reference files outside intended directories or overwrite protected paths.

Attack Vector

The attack vector is network based. An attacker sends crafted requests to a Crosswork interface that processes file name or path parameters. No prior credentials or user interaction are required. Because the vulnerability changes the security scope of impacted operations, downstream services and data managed by Crosswork inherit the compromise. For technical specifics, refer to the Cisco Security Advisory.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose; consult the vendor advisory for reproduction details.

Detection Methods for CVE-2026-20358

Indicators of Compromise

Unexpected file creation, modification, or deletion in Crosswork data and configuration directories
Inbound HTTP or API requests to Crosswork endpoints containing path traversal sequences such as ../ or absolute paths
Unusual process activity on Crosswork nodes tied to file system operations outside normal service directories
Service restarts or crashes correlated with malformed path parameters in application logs

Detection Strategies

Inspect Crosswork application and access logs for file or path parameters containing traversal characters, encoded separators, or absolute path prefixes
Baseline expected file system activity for Crosswork service accounts and alert on deviations
Correlate network requests to management interfaces with subsequent file system change events on the host

Monitoring Recommendations

Enable verbose request logging on Crosswork management endpoints and forward to a centralized analytics platform
Monitor integrity of Crosswork binaries, configuration files, and certificate stores with file integrity monitoring
Alert on privileged file operations initiated by the Crosswork service account outside its expected working set

How to Mitigate CVE-2026-20358

Immediate Actions Required

Apply the Cisco Crosswork hardening release referenced in the Cisco Security Advisory
Restrict network access to Crosswork management interfaces to trusted administrative networks only
Audit Crosswork hosts for unexpected file system changes since the last known-good state
Rotate credentials, API tokens, and certificates managed by Crosswork if compromise is suspected

Patch Information

Cisco released a software hardening version of Crosswork that resolves CVE-2026-20358 along with additional internally discovered issues. Upgrade to the fixed release listed in the vendor advisory. Cisco has not published evidence of exploitation in the wild, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Place Crosswork management interfaces behind a jump host or VPN with strict access control lists
Apply web application firewall rules to block requests containing path traversal patterns targeting Crosswork endpoints
Enforce least-privilege file system permissions for the Crosswork service account until patching is complete

bash

# Example: restrict management interface access at the network edge
# Replace <mgmt-ip> and <trusted-cidr> with values for your environment
iptables -A INPUT -p tcp -d <mgmt-ip> --dport 443 -s <trusted-cidr> -j ACCEPT
iptables -A INPUT -p tcp -d <mgmt-ip> --dport 443 -j DROP