Vulnerabilities

Cisco BroadWorks is a carrier-grade platform that telecom operators use to run voice over internet protocol (VoIP) calling and unified communications for their subscribers. On November 10, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a BroadWorks flaw, CVE-2026-20320, to its Known Exploited Vulnerabilities (KEV) catalog, the list of bugs it has confirmed are being used in real attacks. US federal civilian agencies have until November 24 to fix it.

The flaw carries a Common Vulnerability Scoring System (CVSS) rating of 7.5 out of 10. Someone with no account on the system can send crafted data to BroadWorks and read files off the server underneath it. Cisco shipped the fix in August, so any operator still on an older release has had the patch sitting available for about three months while attackers found the exposed instances.

How it works

BroadWorks exposes the Open Client Interface (OCI), a programming interface that provisioning systems and applications use to create accounts, change settings and query the platform. OCI speaks XML (Extensible Markup Language), a text format for structured data. Cisco's advisory, cisco-sa-bworks-xxe-uwUd7CEt, traces the bug to how the OCI parser reads that XML.

The bug class is XML external entity injection, usually shortened to XXE. XML lets a document declare entities, which are shortcuts that expand into other content when the document is read. The standard also allows an entity to point at an outside resource, such as a file on the server's disk. A parser that resolves those references will happily open the file an attacker names, for example a system password file or a BroadWorks configuration file, and pull its contents in. The OCI parser resolved external entities by default, so a crafted OCI message could name a file and have the server read it.

This one is a blind out-of-band XXE, and that detail changes how you spot it. The parser does not echo the file contents back in its reply, so an attacker watching only the response sees nothing useful. Instead the attacker writes the entity so the server itself opens an outbound network connection to a host they control and carries the stolen file contents in that request. The data leaves through a side channel rather than the normal answer, which is why ordinary request and response logging can miss it.

No login is needed, and that is what makes this serious on a telecom platform rather than a curiosity. Anyone who can reach the OCI service over the network can read files with the permissions of the BroadWorks service account. On a carrier system those files can hold service credentials, routing configuration and subscriber data, so a read-only bug turns into a foothold for everything that follows.

What attackers are doing

When Cisco published the advisory on August 19, it said it had no reports of the flaw being used. That changed by November, when CISA moved it onto the KEV catalog alongside a note that federal agencies had two weeks to patch.

The detail on who is doing the exploiting comes from one threat-intelligence report, published November 8 by Malbear Labs, that Cisco and CISA have not confirmed. The report ties the flaw to a campaign against a European telecom provider in which the operator ran the intrusion through an autonomous artificial-intelligence harness rather than by hand. According to that report, the activity centred on mapping the provider's assets, stealing credentials, and pulling subscriber billing and device records out of the platform.

The same report says the provider's provisioning server was also left open through an unauthenticated directory listing, and that at least 13 organisations relying on the provider's services may have been caught in the campaign. Treat the attacker identity, the count and the AI angle as a single source's account, not settled fact. What is confirmed is narrower and still enough to act on: the flaw is on the KEV catalog, which means CISA has evidence it is being exploited.

CISA flagged a second messaging-platform flaw the same day, CVE-2026-111793 in the Openwave Messaging Webtop Media Transcoder, where administrator-set limits on which file types may be converted are not enforced. It is a lower-rated issue, CVSS 4.3, and it needs an authenticated user, so it is not the headline here, but anyone running Webtop should treat it as on the same patch list.

What to do

1. Upgrade to BroadWorks release RI.2026.07 or later. That release fixes CVE-2026-20320 across the affected components, including the Application Server, Profile Server and Application Delivery Platform. Cisco lists no workaround, so patching is the only real fix.
2. Because there is no workaround, keep the OCI and management interfaces off the public internet while you roll the update. Put BroadWorks behind network controls so only trusted provisioning hosts can reach the OCI service, rather than leaving it open to anyone who finds the port.
3. Check for exploitation on both sides of the connection. In web and XML request logs, look for OCI messages carrying a document type definition or an ENTITY declaration, which a normal OCI client never sends. On the host, look for outbound connections from the BroadWorks server to external addresses you do not recognise, since that out-of-band channel is where the data left.
4. Scan your provisioning servers for unauthenticated directory listings, the second exposure described in the exploitation report, and close any you find.
5. Rotate anything the platform could have handed over while it was exposed: service-account passwords, credentials stored in configuration files, and any keys those files held.
6. Note the November 24 federal deadline. Even if it does not bind your organisation, it is a reasonable target date for an internet-facing platform already confirmed under attack.
7. If you run Openwave Webtop, apply its fix as well. The Media Transcoder issue is addressed in version 1.1.22.0 and later.

An OCI interface reachable from the wrong network is the kind of exposure our attack surface management work is built to catch before someone else does, and the fail-open XML parsing behind this bug is exactly what a network penetration test or web application test goes looking for. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: CISA KEV catalog addition, November 10, 2026, Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt, NVD entry for CVE-2026-20320, BleepingComputer on the KEV listing, SecurityWeek on the Openwave and BroadWorks exploitation, SC World on the BroadWorks KEV addition.