CISCO: Reference: Cisco Security Advisory Notice (Aug 19, 2026)

CISCO Security Advisory

Published Date: Not specified

CVE: CVE-2026-20030

Advisory Summary

📅 August 19, 2026

🏷️ Title: Cisco PSIRT Advance Notification — Aug 19, 2026 Security Advisories

🚨 Key Market Takeaway (What matters now)
Cisco’s PSIRT published multiple security advisories on Aug 19, 2026, including two Critical (CVSS 10.0) hardening releases that can materially affect enterprise deployments across automation/orchestration and secure workload platforms. In parallel, Cisco disclosed a High-impact injection issue in BroadWorks integration components and several Medium web/API issues spanning contact center and industrial switching.

—

• Rating: Critical | CVSS: 10.0
• CVE(s): CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, CVE-2026-20359
• Operational risk: Hardening release items at max CVSS typically indicate remotely triggerable weaknesses or conditions that can quickly escalate compromise if exposure exists.

• Rating: Critical | CVSS: 10.0
• CVE(s): CVE-2026-20231, CVE-2026-20315, CVE-2026-20317, CVE-2026-20318, CVE-2026-20319
• Operational risk: Secure workload plane flaws at CVSS 10.0 warrant fast remediation—especially for workloads reachable from untrusted networks.

—

• Rating: High | CVSS: 7.5
• CVE: CVE-2026-20320
• Threat model note: XXE (even “blind”) can enable sensitive data extraction or backend interactions depending on configuration and parser behavior—monitor integrations closely.

• Rating: Medium | CVSS: 6.5
• CVE: CVE-2026-20327
• Risk: SQLi may enable data access/manipulation depending on authZ and parameter exposure paths.

• Rating: Medium | CVSS: 6.1
• CVE: CVE-2026-20302
• Risk: Stack overflow often implies crash potential and may enable control-flow issues in certain environments.

• Stored Cross-Site Scripting (XSS):
• Rating: Medium | CVSS: 5.4 | CVE: CVE-2026-20232
• Denial of Service (DoS):
• Rating: Medium | CVSS: 5.3 | CVE: CVE-2026-20177
• Risk: Industrial edge devices are frequently less monitored; stored XSS can impact operators/admins, while DoS can disrupt operations.

• Rating: Medium | CVSS: 5.0
• CVE: CVE-2026-20314
• Risk: SSRF can become a stepping stone to internal network access or metadata exposure depending on egress controls.

—

• Prioritize Critical (CVSS 10.0) hardening releases first: Crosswork and Secure Workload—target “fixed software” referenced in the advisories and validate with your regression/UAT plan.
• Inventory exposure by product family and internet/internal reachability:
• Public-facing vs. internal-only surfaces for BroadWorks, UCIC, contact center, and RoomOS/industrial endpoints.
• Shorten detection-to-patch windows:
• For injection/SSRF classes (CVE-2026-20320, CVE-2026-20314, CVE-2026-20327), ensure logging coverage for exploit attempts and upstream request patterns.
• Industrial environments: confirm change windows and safety constraints before patching Industrial Ethernet switch firmware—especially where operator consoles/web interfaces are accessible.

—

ℹ️ Process Note
Cisco reiterates that customers should upgrade to fixed software indicated in each advisory to fully remediate the disclosed vulnerabilities.

—

🔗

-2026

Reference: Vendor Advisory