CVE-2026-20359 bundles multiple CWE-522 findings in Cisco Crosswork — enterprise networking software that sits at the center of managed infrastructure, handling credentials for dozens of downstream systems, provisioning, and operator management interfaces. The CVSS 9.9 rating reflects reality, not marketing: a single credential extraction path in software this interconnected gives an attacker keys to everything Crosswork was authorized to touch. That's the blast radius that matters.
The critical dimension most vulnerability prioritization frameworks miss is the compound exposure window. CVSS captures severity at discovery, not the risk accumulated during the gap between introduction and remediation. For clustered CWE-522 findings, each day multiple credential pathways coexist in a system managing infrastructure trust, the attack surface doesn't just persist — it compounds. An attacker who finds one pathway can use it to discover the others. Measure your exposure as pathway count multiplied by time, not time alone.
These pathways don't live in fresh code that SAST rules catch — they hide in the sediment layer: deprecated integration modules carried forward through refactors because nobody was sure if operations needed them, diagnostic endpoints from 2019 that still reference credential variables that technically still exist, legacy API handlers marked 'stable' so nobody audits them. Standard static analysis tools tuned to current credential handling flows miss these because they don't model temporal decay. What you need is credential flow analysis that flags any code path reaching a credential variable in components with names like 'legacy', 'diagnostic', 'debug', or 'integration' — regardless of when that code was last actively modified.
If the patch addresses the credential architecture itself rather than just the specific extraction paths discovered, expect this pattern to recur in 18-24 months. The fix lives in whether Cisco moved to a shared credential library that makes insecure patterns genuinely difficult to implement, not whether they patched three logging calls.