CVE-2026-20220

A vulnerability in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to insufficient input validation in the configuration template engine of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system in limited areas of the file system. This vulnerability affects only areas of the operating system for which the template user has write permissions.  To exploit this vulnerability, the attacker must have valid template user credentials with write permissions. Template users with read permissions cannot exploit this vulnerability. 

• CWE-74

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnc-inj-QNMeEmxkVendor Advisory

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20214A vulnerability in the FSG file format parser of ClamAV coul…7.5
• CVE-2026-20215A vulnerability in the 7z file format parser of ClamAV could…7.5
• CVE-2026-20216A vulnerability in the InstallShield file format parser of C…7.5
• CVE-2026-20217A vulnerability in the PESpin file format parser of ClamAV c…7.5
• CVE-2026-20219A vulnerability in the REST API of Cisco Slido could have al…5.4
• CVE-2026-2022The Smart Forms plugin for WordPress is vulnerable to unauth…4.3
• CVE-2026-20223A vulnerability in the access validation of internal RE…10
• CVE-2026-20224A vulnerability in the web UI of Cisco Catalyst SD-WAN Manag…8.6
• CVE-2026-2023The WP Plugin Info Card plugin for WordPress is vulnerable t…4.3
• CVE-2026-20230A vulnerability in Cisco Unified Communications Manager (Uni…8.6
• CVE-2026-20233A vulnerability in the web-based user interface of Cisco Web…6.1
• CVE-2026-20238In Splunk AI Toolkit versions below 5.7.3, a low-privileged …6.5