CISA has added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog, which confirms active exploitation. The flaw is an unauthenticated XML external entity (XXE) vulnerability in Cisco BroadWorks that exposes sensitive configuration data.
What Is It
CVE-2026-20320 is an improper restriction of XML external entity reference vulnerability (CWE-611). It sits in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. The parser allows external entity resolution by default and does not parse XML entries safely. An attacker can exploit this by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. If the exploit works, the attacker can read sensitive files on the filesystem with the privileges of the Cisco BroadWorks user.
Cisco PSIRT scores the flaw CVSS 3.1 7.5 (HIGH), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack works over the network and has low complexity. It needs no privileges and no user interaction. The impact is limited to confidentiality. NVD published the CVE on 2026-08-19.
Why It Matters
CISA added CVE-2026-20320 to the KEV catalog on 2026-11-10, which confirms active exploitation. CISA's SSVC assessment rates exploitation as active, automatable as yes, and technical impact as partial. NVD also links a third-party write-up from Malbear Labs that is tagged "Exploit".
Known ransomware campaign use is listed as Unknown. The attack needs no authentication and can be automated, so any exposed OCI-P service should be treated as a priority.
What's Vulnerable
NVD's configuration data lists these Cisco BroadWorks components as vulnerable:
- BroadWorks Application Delivery Platform, versions before RI.2026.07
- BroadWorks Application Server (release independent): NVD's listed upper bound is "2026.0". This does not match the 2026.07 bounds given for the other components, so check the Cisco advisory for the exact affected and fixed versions.
- BroadWorks Profile Server (release independent), versions before 2026.07
- BroadWorks Xtended Services Platform (release independent), versions before 2026.07
The vulnerable code is in the OCI XML Parser, and the attack goes through the OCI-P service.
Patch Status
CISA's required action is to apply mitigations according to Cisco's instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Organizations should follow the BOD 26-04 guidance for cloud services, or stop using the product if mitigations are not available. Stakeholders are responsible for evaluating each asset's internet exposure.
- KEV due date: 2026-11-24
- Forensic triage flag: No
NVD's version bounds suggest that fixed releases exist. Consult the Cisco advisory for the exact fixed versions and any workarounds.