SB2026061769 - Server-side template injection in Cisco Crosswork Network Controller

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061769

SB2026061769 - Server-side template injection in Cisco Crosswork Network Controller

Published: June 17, 2026

Security Bulletin ID SB2026061769
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-20220)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to insufficient input validation in the configuration template engine of the web-based management interface when handling crafted requests. A remote user can send a crafted request to execute arbitrary commands.

Command execution is limited to areas of the underlying operating system file system for which the template user has write permissions. Template users with read permissions cannot exploit this vulnerability.


Remediation

Install update from vendor's website.

References