Brief Summary: CVE-2026-20188 Connection Exhaustion DoS in Cisco Crosswork Network Controller and Network Services Orchestrator

Introduction

Two of Cisco's core network automation platforms do not rate-limit incoming connections. An unauthenticated remote attacker can exhaust their connection resources and leave the system unresponsive until someone reboots it manually. Some service providers and large enterprises use Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO) as the central orchestration layer for network service provisioning. For them, this vulnerability (CVE-2026-20188, CVSS 7.5) is a direct path to operational disruption across potentially thousands of managed devices.

Cisco Crosswork Network Controller is an SDN controller for IP Transport networks. It consolidates service lifecycle management and device management to simplify operational workflows. Cisco Network Services Orchestrator is a multivendor, cross-domain automation platform that connects business intent to the underlying physical and virtual infrastructure. It supports Cisco devices and more than 1,000 third-party device types. Many of the world's largest network operators build their automated network operations on these two products.

Technical information

The root cause of CVE-2026-20188 is classified under CWE-400 (Uncontrolled Resource Consumption). The connection-handling mechanism in both Cisco CNC and Cisco NSO does not adequately rate-limit incoming network connections. The system accepts connection requests and tries to process them without any ceiling on concurrent or per-interval connections, so its finite pool of connection resources can be exhausted.

The CVSS 3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It breaks down as follows:

There is no confidentiality or integrity impact.

Attack flow

1. The attacker finds a network-reachable instance of Cisco CNC or Cisco NSO running a vulnerable version.
2. The attacker sends a large volume of connection requests to the target. The requests need no authentication, and no special crafting beyond being valid connection attempts.
3. With no effective rate limiting in place, each request consumes part of the system's finite connection resource pool.
4. Once the pool is fully exhausted, the system cannot accept new connections from any source, including legitimate administrators, API consumers, and dependent services.
5. The system becomes completely unresponsive and cannot recover on its own. Restoring it takes a manual reboot.

That reboot is where the operational cost comes from. If out-of-band management access is not available, recovery may require physical intervention at the data center, which extends the outage considerably.

The vulnerability does not depend on device configuration. No feature toggle, enabled service, or non-default setting has to be active for the system to be vulnerable. Any deployment of an affected version is exposed by default.

Scope of impact

CNC and NSO are central orchestration points, so a denial of service against them reaches well past a single device. It can halt service provisioning, configuration management, and lifecycle operations across the entire managed network domain. Services that depend on API connectivity to CNC or NSO will fail too, and the disruption cascades from there.

Patch information

Cisco has released fixed software under advisory ID cisco-sa-nso-dos-7Egqyc (Bug ID: CSCwr08237). The patch adds connection rate limiting so that remote unauthenticated attackers cannot exhaust connection resources. Cisco confirms there are no workarounds for this vulnerability. Upgrading is the only remediation path.

Cisco Crosswork Network Controller (CNC)

CNC users should move to release 7.2, which was designed without the vulnerable connection-handling logic.

Cisco Network Services Orchestrator (NSO)

NSO users on the 6.4 train can apply the targeted patch in 6.4.1.3. Users on NSO 6.3 or earlier must do a full version migration, because no backports are available for older release trains. NSO 6.5 ships without the vulnerability.

The list of affected versions is long. The CVE record names 18 affected CNC versions and 81 affected NSO versions, with the NSO versions spanning the 5.6.x through 6.0.x release branches. That range shows how long the flawed connection-handling code has been in the codebase.

Because a successful attack leaves the system unresponsive until a manual reboot, organizations should also make sure they have physical or out-of-band management access for emergency reboots, in case an attack happens before patching is complete.

Affected systems and versions

Cisco Crosswork Network Controller:

• All releases through version 7.1 are vulnerable (18 affected versions listed in the CVE record)
• Version 7.2 is not vulnerable

Cisco Network Services Orchestrator:

• All releases through version 6.3 are vulnerable
• Version 6.4 (prior to 6.4.1.3) is vulnerable
• Version 6.4.1.3 is the fixed release for the 6.4 train
• Version 6.5 is not vulnerable
• The CVE record lists 81 affected NSO versions spanning the 5.6.x through 6.0.x release branches

Any deployment of the listed versions is affected by default, whatever its device configuration.

Vendor security history

Cisco has a dedicated Product Security Incident Response Team (PSIRT) that manages vulnerability disclosure and remediation guidance. The advisory uses a structured format, includes fixed-release tables, and states clearly that no workarounds exist, which points to an established incident response process. Cisco published the advisory for CVE-2026-20188 on May 6, 2026, and fixed releases were available at the time of disclosure.

References

• NVD Entry for CVE-2026-20188
• Cisco Security Advisory: cisco-sa-nso-dos-7Egqyc
• CVE Record for CVE-2026-20188
• Cisco Crosswork Network Controller Data Sheet
• Cisco Network Services Orchestrator Data Sheet