Cisco Crosswork Planning CVE-2026-20357

Exploitation requires network reachability to the affected Cisco Crosswork Planning service (versions 7.0.0-7.2.0) and the ability to invoke the specific critical function that is missing an authentication check (CWE-306); per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no special conditions - no credentials, no privileges, and no user interaction are needed against affected deployments. The primary limiting factor is exposure: the attacker must be able to reach the vulnerable management interface/endpoint over the network, so instances confined to a segmented management network or behind a firewall/VPN are far harder to reach than internet-exposed ones. Cisco did not publish a non-default configuration prerequisite in the available data, so the flaw should be treated as exploitable against default/affected installations once network access exists.

The signals point to a genuine top-priority issue rather than an inflated high-CVSS score: CVSS 3.1 base is 10.0 with the most exploitable possible vector - AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction) - combined with full C/I/A impact and a scope change. That means, on paper, a remote unauthenticated attacker with network reachability can fully compromise the system. Tempering that: no EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or imminent exploitation, and no public exploit identified at time of analysis. The vulnerability was found internally by Cisco (not disclosed after in-the-wild abuse), suggesting exploitation is currently theoretical but trivially achievable once details or code become public given the CWE-306 class and the maximal vector. SSVC-style read: exploitation=none observed, but automatable=likely (unauthenticated network function) and technical impact=total - a strong case for expedited patching. Exposure is the main real-world limiter: Crosswork Planning is typically deployed on internal/management networks, so internet-facing instances would be far higher risk than segmented ones.

An attacker with network access to the Crosswork Planning management interface sends a crafted request directly to the affected function that fails to enforce authentication, requiring no credentials, no user interaction, and only low complexity. With the missing-auth check bypassed, the attacker reads or manipulates sensitive planning data and, given the scope change and full C/I/A impact, gains control that can extend to connected resources. No public exploit is identified at time of analysis, so this scenario is currently based on the CVSS vector and CWE-306 class rather than an observed campaign.