SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20357

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 10 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

10

Technische Schwere

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20357 are related to missing authentication for critical function issues that are grouped under the Common Weakness Enumeration (CWE) CWE-306.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 7.2.1-SP

Threat-Hunting-Queries

Die Schwachstelle CVE-2026-20357 betrifft 'Missing authentication for critical function' (CWE-306) in Cisco Crosswork Produkten. Da keine spezifischen IOCs oder Angriffspfade genannt werden, konzentrieren sich die Detektionsregeln auf ungewöhnliche oder nicht authentifizierte Zugriffe auf kritische Funktionen oder Ressourcen der betroffenen Cisco Crosswork-Produkte. Dies erfordert eine Anpassung a

Sentinel/Defender KQL

CiscoCrossworkLogs
| where Message contains "authentication failure" or Message contains "unauthorized access" or Message contains "missing authentication" or Message contains "critical function access attempt"
| where SourceProduct in ("Crosswork Data Gateway", "Crosswork Network Controller", "Crosswork Planning")
| summarize count() by SourceProduct, Message, RemoteIP, AccountName
| extend Severity = "High"

Splunk SPL

index=cisco_crosswork (authentication failure OR unauthorized access OR missing authentication OR critical function access attempt) (SourceProduct="Crosswork Data Gateway" OR SourceProduct="Crosswork Network Controller" OR SourceProduct="Crosswork Planning")
| stats count by SourceProduct, _raw, clientip, user
| eval severity="High"

Sigma

title: Cisco Crosswork Missing Authentication
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential attempts to exploit CVE-2026-20357 (Missing authentication for critical function) in Cisco Crosswork products.
author: SecBoard
date: 2026/08/19
logsource:
  product: cisco_crosswork
  service: *
detection:
  selection:
    Message|contains:
      - 'authentication failure'
      - 'unauthorized access'
      - 'missing authentication'
      - 'critical function access attempt'
  condition: selection
level: high

Elastic ES|QL

FROM cisco_crosswork_logs
| WHERE message LIKE '%authentication failure%' OR message LIKE '%unauthorized access%' OR message LIKE '%missing authentication%' OR message LIKE '%critical function access attempt%'
| WHERE source_product IN ('Crosswork Data Gateway', 'Crosswork Network Controller', 'Crosswork Planning')
| STATS count() BY source_product, message, remote_ip, account_name
| SET severity = 'High'

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen