Cisco Releases Security Updates to Address CNC and NSO Vulnerabilities

Cisco has recently rolled out security patches to resolve a denial-of-service (DoS) vulnerability affecting its Crosswork Network Controller (CNC) and Network Services Orchestrator (NSO) platforms. This vulnerability necessitates manual system reboots for recovery.

The CNC software suite is widely used by large enterprises and service providers to streamline multivendor network management through automation. On the other hand, the NSO orchestration platform helps in effectively managing network devices and resources.

The identified vulnerability, tracked as CVE-2026-20188, is classified as high-severity and is attributed to inadequate rate limiting on incoming network connections. Exploitation of this flaw by unauthorized individuals can lead to the crashing of unpatched Cisco CNC and Cisco NSO systems through relatively simple attacks.

Cisco has emphasized the importance of upgrading to the fixed software versions specified in the advisory to mitigate the risk posed by CVE-2026-20188. Failure to do so could result in a denial-of-service condition for legitimate users and dependent services, necessitating manual system reboots to recover.

While the vulnerability has the potential to cause significant disruptions until addressed, Cisco’s Product Security Incident Response Team (PSIRT) has not detected any active exploitation of CVE-2026-20188.

Recommended Actions for Cisco CNC and NSO Users

Although CVE-2026-20188 has not been exploited in the wild yet, Cisco has a history of addressing and patching DoS vulnerabilities that have been leveraged in attacks.

For instance, back in November 2025, Cisco warned about two security flaws (CVE-2025-20362 and CVE-2025-20333) that were being actively exploited to trigger reboot loops in ASA and FTD firewalls.

In a similar vein, in September, following the patching of these vulnerabilities, CISA issued an emergency directive mandating federal agencies to secure their Cisco firewalls within 24 hours to thwart attacks utilizing this exploit chain.

Cisco has also resolved vulnerabilities (CVE-2022-20653 and CVE-2024-20401) that could potentially lead to the crashing of Secure Email appliances through the use of malicious email messages.

Customers were advised by Cisco to engage its Technical Assistance Center (TAC) for assistance in bringing affected systems back online, as manual intervention was necessary.

Furthermore, Cisco previously addressed a DoS vulnerability (CVE-2025-20115) that enabled attackers to crash the Border Gateway Protocol (BGP) process on IOS XR routers via a single BGP update message.

Artificial Intelligence has successfully chained four zero-day vulnerabilities into a single exploit, bypassing both renderer and OS sandboxes. Stay vigilant as a surge of new exploits is anticipated.

Discover more about autonomous validation at the upcoming Autonomous Validation Summit on May 12 & 14. Witness how autonomous, context-rich validation identifies exploitable vulnerabilities, validates control efficacy, and closes the remediation loop.

Claim Your Spot