A flaw in the connection‑handling mechanism of Cisco Crosswork Network Controller and Cisco Network Services Orchestrator allows an attacker who does not need to be authenticated to flood the system with a large number of connection requests. The inadequate rate limiting causes the service to consume all available connection resources, rendering the controller or orchestrator unresponsive. The resulting denial of service requires a manual reboot to restore normal operation. This vulnerability directly affects the availability of the affected services.

Cisco Crosswork Network Change Automation and Cisco Network Services Orchestrator are impacted. Specific version information is not supplied in the advisory.

The CVSS score of 7.5 indicates a high severity potential. EPSS data is not available, so the current probability of exploitation cannot be quantified from this advisory. The vulnerability is not listed in CISA's KEV catalog. Because the attack requires only unauthenticated remote access and relies on sending many connections, an attacker with network reach to the affected system can exploit it using readily available tools, and escalation of privileges is not required.