GoKawiilCISA adds Cisco BroadWorks flaw CVE-2026-20320 to exploited vulnerabilities list
CISA confirmed active exploitation of a high-severity flaw in Cisco BroadWorks, a cloud platform telecom carriers and MSPs use to deliver hosted PBX and collaboration services. The bug, an XXE weakness in the Open Client Interface XML Parser, lets unauthenticated remote attackers extract sensitive configuration data via crafted XML messages, and Cisco patched it in August. CISA has added it to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to remediate by November 24 under Binding Operational Directive 26-04.
GoKawiil's interpretation of the reporting above, not reported fact.
The directive legally binds only federal civilian agencies, but CISA's public push for all organizations to prioritize the patch suggests exploitation may already extend beyond government networks. Because the flaw exposes configuration data from a platform underpinning many carriers' and MSPs' voice services, unpatched systems could give attackers insight useful for further intrusions or service disruption. The case also underscores how quickly disclosed vulnerabilities in widely used telecom infrastructure attract active exploitation once patches reveal the underlying weakness.
- CVE-2026-20320 is an XXE flaw in Cisco BroadWorks' OCI-P XML Parser allowing unauthenticated data exposure.
- CISA added it to the KEV Catalog, giving federal agencies until November 24 to patch under BOD 26-04.
- CISA is urging private-sector organizations using BroadWorks to patch as well, given confirmed active exploitation.
Source: bleepingcomputer.com, 2026-11-11
Published there as: “CISA flags Cisco BroadWorks flaw as actively exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.