CISA lists Cisco BroadWorks XXE flaw as exploited, due 24 November

CISA lists Cisco BroadWorks XXE flaw as exploited, due 24 November

10 November 2026: CISA has added CVE-2026-20320, a flaw in Cisco BroadWorks that lets an attacker without credentials read sensitive configuration files, to its catalogue of vulnerabilities exploited in the wild. US federal agencies must deal with it by 24 November 2026. Cisco fixed it in BroadWorks release RI.2026.07 and says there is no workaround.

How the BroadWorks flaw works

BroadWorks is the call-control platform many telecom operators and hosted voice providers run their business phone services on. The flaw sits in the Open Client Interface, Provisioning service, known as OCI-P, which accepts XML messages. Resolution of XML external entities is switched on by default, so a crafted message can make the server read files it should never return. Cisco scores it 7.5.

The affected components are the Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform, and Cisco says they are affected whatever their configuration. Release RI.2026.07 fixes all four; earlier releases are vulnerable. The Cisco bug ID is CSCwv48590.

Two sources that disagree

Cisco first published the advisory on 19 August. When we read it on 10 November, it still said Cisco's security team was not aware of any malicious use. CISA's listing the same day says the opposite, without saying who is exploiting it or how. Cisco's page has simply not caught up.

For an operator, the configuration files OCI-P can expose are what makes this serious: provisioning credentials and integration settings are the kind of data that turns a read-only bug into wider access. An operator still below RI.2026.07 should check whether OCI-P is reachable from anything but its own provisioning systems, and rotate the credentials stored on any server that was.

Business customers of a hosted voice service built on BroadWorks cannot patch it themselves. The useful question to their provider is which BroadWorks release it runs. We list 15 products in VoIP software.

An old Openwave fix, a new listing

CISA added CVE-2026-111793 in Openwave Messaging's Webtop Media Transcoder on the same day, also due 24 November. Openwave's advisory says the transcoder did not enforce the file-type restrictions an administrator sets, so an authenticated user who bypasses the webmail interface could have unintended document types converted. Openwave scores it 4.3, medium.

The fix is old: version 1.1.22.0, released on 6 December 2021, although the advisory was only disclosed on 7 October 2026. Openwave tells customers to move to the latest supported release of Media Server 2.0. A webmail operator still running a transcoder older than 1.1.22.0 is five years behind on that component.

Sources

• Cisco: Cisco BroadWorks XML External Entity Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt), first published 19 August 2026, 19 August 2026
• Openwave Messaging: public security advisory CAN-2026-2032674, disclosed 7 October 2026, 7 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, entries added 10 November 2026, 10 November 2026