This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Cisco fixes 15 vulnerabilities in various products

Cisco fixes 15 vulnerabilities in its products, 9 of them critical in the products Secure Workload and Crosswork, which it published grouped by class of flaw, without further details on the individual flaws [1][2]. The most severe of the other vulnerabilities are described below, the rest can be found at [9]. Products and their fixed versions: Cisco Secure Workload – 3.10.9.1, 4.0.4.16 [1] Cisco Crosswork – 7.2.1-SP [2] Cisco BroadWorks – RI.2026.07 [3] Cisco Packaged Contact Center Enterprise, Cisco Unified Contact Center Enterprise – 15.0(1)ES202607 [4] Cisco RoomOS – 11.32.7.0, 11.40.1.1, 26.7.2.2, 26.7.1.12 [5] Cisco Industrial Ethernet 1000 Series Switches – 1.9.6 [6][7] Cisco Unified Intelligence Center – 12.6(2) ES08, 15.0(1) SU2 [8] *For Cisco Secure Workload, the Cluster, Agent and Connector software must all be updated. For SaaS deployments, Cisco has already updated the Cluster and customers only need to update the Agent and Connector [1].

Cisco BroadWorks - information disclosure (CVE-2026-20320)
CVSS 7.5 (High)

Because processing of external XML entities is enabled by default in the XML parser of the Open Client Interface, an unauthenticated remote attacker can use a specially crafted XML message to read sensitive files from the file system with the privileges of the user under which Cisco BroadWorks runs [3].

The vulnerability is present in products:

  • Cisco BroadWorks Application Delivery Platform; <RI.2026.07
  • Cisco BroadWorks Application Server; <RI.2026.07
  • Cisco BroadWorks Profile Server; <RI.2026.07
  • Cisco BroadWorks Xtended Services Platform; <RI.2026.07

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 19. 8. 2026.

Cisco Unified Intelligence Center - SQL injection (CVE-2026-20327)
CVSS 6.5 (Medium)

Due to insufficient input validation in the web interface, an authenticated remote attacker with low privileges can use a specially crafted request to carry out a blind SQL injection attack and read the contents of the device's internal database [8].

The vulnerability is present in product:

  • Cisco Unified Intelligence Center; >=12.6, <12.6(2)ES08; >=15.0, <15.0(1)SU2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

  • CVE-2026-20327 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 19. 8. 2026.

Cisco RoomOS - RCE (CVE-2026-20302)
CVSS 6.1 (Medium)

An unauthenticated attacker with physical access to the device can, due to insufficient boundary checking in the USB driver, cause a stack overflow by connecting a malicious device and execute arbitrary code with root privileges [5].

The vulnerability is present in product:

  • Cisco RoomOS; <=11.32.7.0; >=26, <26.7.2.2

CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

  • CVE-2026-20302 at cve.org, NVD
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org

The vulnerability was publicly disclosed 19. 8. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 20. 8. 2026.

CESNET, z.s.p.o. Logo