Cisco Confirms Exploitation of BroadWorks XXE CVE-2026-20320, 85 Days After Its Advisory
Security / news
Cisco Confirms Exploitation of BroadWorks XXE CVE-2026-20320, 85 Days After Its Advisory
The unauthenticated file-read flaw was rated 7.5 in August with no workaround; CISA added it to its exploited list on November 10.
An unauthenticated attacker who can reach the OCI-P provisioning service of a Cisco BroadWorks server can send one crafted XML message and read files from the host as the BroadWorks user. Cisco now says it knows this is being exploited, and CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on November 10.
Federal civilian agencies have until November 24 to apply the fix. Cisco's advisory says there are no workarounds, so the only mitigation is upgrading to release RI.2026.07.
The timeline
Cisco first published the advisory on August 19, 2026 at 16:00 GMT and revised it to version 1.1 on November 12 at 17:25 GMT. The revision states that Cisco PSIRT became aware of active exploitation in November 2026.
| Date | Event |
|---|---|
| August 19 | Cisco publishes cisco-sa-bworks-xxe-uwUd7CEt, fix in RI.2026.07 |
| November 10 | CISA adds CVE-2026-20320 to KEV, due date November 24 |
| November 12 | Cisco revises advisory to version 1.1 to reflect exploitation |
The gap is 85 days from the first advisory to the revision. The advisory does not say who is exploiting the flaw, how many servers are affected, or when in November the first attack was seen.
What the flaw needs and gives
Cisco's bug ID is CSCwv48590 and the weakness class is CWE-611. The XML parser behind the Open Client Interface resolves external entities by default, so a crafted message makes the server read local files and send content out of band. Cisco rates it 7.5 on CVSS 3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Cisco says affected products are vulnerable "regardless of device configuration", and lists four: the BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. Sandesh M Gawai is credited with the report.
The score understates what an exploit chain may reach. Confidentiality is the only impact rated, and that is accurate for the bug itself. A file read as the BroadWorks user can still expose configuration and credentials on the host. The advisory does not list which files, so how far an intruder gets after the read is not documented.
Why the gap matters
A flaw with a public fix and no workaround leaves one decision to defenders: upgrade or accept the exposure. For three months the advisory carried no exploitation flag, so teams ranking work by that flag would have placed it below anything marked exploited. The revision on November 12 and the KEV entry two days earlier change that ranking, and the federal deadline gives a fixed date to plan against.
BroadWorks is Cisco's carrier-grade voice platform, so affected servers tend to sit with service providers and large enterprises that run their own telephony. The advisory does not give a count of exposed servers, and the sources reviewed here do not either.
What operators should check
Upgrade every one of the four component types to RI.2026.07 or later. One line of the advisory's fixed-release table for the Application Delivery Platform reads "RI.2026.071", which looks like a typo, so confirm the build number with Cisco before closing a ticket. A server whose OCI-P port is reachable from the internet should be treated as a priority, because the attack needs no login.
Other exploited flaws added to the same catalog this month include the Barracuda ESG chain and a Chrome 157 zero-day.
Sources
More in Security
- 01FreeSWITCH 1.11.3 Fixes a SIP MESSAGE Flaw Already Used in AttacksOne accepted chat message lets a peer pick which FreeSWITCH API command the server runs, and the default config leaves chat switched on.
- 02A 2022 Samsung TV Still Trusted a Compromised eMudhra Certificate, and Its Owner Used That to Swap the AdsDaniel Vrátil replaced Smart Hub banner ads with family photos by signing a certificate with a key the industry had already distrusted.
- 03PostgreSQL 18.7 Fixes CVE-2026-6460, a Type Confusion That a Researcher Turned Into Code ExecutionThe project's advisory says an object creator is needed. The researcher says the lowest-privileged login role is enough.
- 04Exploited Outlook Spoofing Bug CVE-2026-124194 Sends Credentials to an Attacker's Server, and Qualys Prints Two TotalsOpening a crafted message file can make Outlook connect to an attacker-controlled location without the usual warning.