Cisco BroadWorks XXE flaw exploited, added to KEV (CVE-2026-20320)

CISA added an unauthenticated information-disclosure flaw in Cisco BroadWorks to its Known Exploited Vulnerabilities catalog on November 10, confirming attacks in the wild against a flaw Cisco had patched in August with no known exploitation at the time. The bug, CVE-2026-20320 (CVSS 7.5), is an out-of-band blind XML External Entity injection in the Open Client Interface (OCI) XML parser. A remote, unauthenticated attacker sends a crafted OCI message and reads sensitive files with BroadWorks user privileges. If you run BroadWorks, treat the patch as overdue.

What the bug does

Per Cisco's advisory cisco-sa-bworks-xxe-uwUd7CEt (published August 19, 2026), external entity resolution was enabled by default in the OCI-P provisioning service. A crafted XML message pointing at an external entity causes the parser to resolve and return local file contents to the attacker — no credentials and no user interaction required. The flaw was reported by researcher Sandesh M. Gawai.

CISA added a second Cisco-adjacent flaw to KEV the same day: CVE-2026-111793 (CVSS 4.3) in the Openwave Messaging Webtop Media Transcoder, where an authenticated user can process unintended document types. Japan Vulnerability Notes said the developer has observed attacks against it.

Exploitation status

CISA has not published attack details. One vendor account offers more color: Malbear Labs reports a campaign it calls "Operation Snowball" targeting BroadWorks XSP (Release 23.0.1.1075) on port 2208 at a European telecom and 13 hosted organizations, extracting subscriber billing and device records over roughly two weeks. Malbear attributes the activity to an unknown Chinese-speaking operator using an autonomous framework built on a jailbroken DeepSeek model, with Sliver, Chisel, and the Behinder web shell. Treat the attribution and the AI-tooling claim as a single, unverified vendor account — the KEV listing is the hard fact here.

Affected and fixed versions

• Affected: Cisco BroadWorks releases earlier than RI.2026.07, per the advisory.
• Fixed: RI.2026.07. There are no workarounds; apply the fixed release.

Action checklist

1. Upgrade BroadWorks to RI.2026.07 now. This is a KEV item with a federal deadline of November 24 under BOD 26-04 — a useful bar for everyone, not just FCEB agencies.
2. Restrict OCI-P exposure. The OCI provisioning interface (port 2208) should not be reachable from untrusted networks. Put it behind management segmentation.
3. Hunt for OCI abuse. Review OCI-P logs for anomalous XML payloads referencing external entities or local file paths, and for unexpected reads of configuration files.
4. Patch Openwave Webtop against CVE-2026-111793 if you run it.
5. Rotate secrets that may sit in BroadWorks configuration files readable via the XXE if you find evidence of access.

Context

A high-severity flaw sitting unexploited for three months after a patch, then landing on KEV, is the familiar shape of a telecom-infrastructure bug: the fix ships quietly, operators defer the maintenance window, and the window closes when someone weaponizes it. BroadWorks runs voice and unified-comms for a long tail of carriers, which makes any OCI-reachable instance a high-value target. The pattern matches the run of carrier-plane advisories this year — see our coverage of Cisco's Unified CM webshell exploitation. Patch the provisioning plane, then get it off the open internet.