Cisco Crosswork Network Controller Vulnerability Enables Remote Command Execution via Template Injection

Cisco Crosswork Network Controller has been hit by a serious server‑side template injection (SSTI) vulnerability that could let a remote attacker execute arbitrary commands on the underlying operating system.

How the Exploit Works

The bug lies in the web‑based management interface’s configuration template engine, which fails to properly sanitize user input. An attacker who is authenticated as a template user with write permissions can craft a malicious request that injects template code. When the server processes the request, the injected code runs as the template user, allowing the attacker to execute arbitrary commands within the file system areas where the template user has write access.

Template users that only have read permissions cannot exploit the flaw, and the vulnerability does not affect the entire system—only the write‑accessible portions of the OS.

Mitigation

Cisco has released software updates that fix the issue. No workarounds are available, so applying the patch is the only effective defense.

The vulnerability has been assigned CVE‑2026‑20220 and is rated Medium in terms of security impact.