MeridianMeridian

CISA Adds Cisco BroadWorks and Openwave Flaws to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. CVE-2026-20320 is an XML external entity reference flaw in the Open Client Interface XML Parser of Cisco BroadWorks that allows unauthenticated remote attackers to read sensitive configuration data. CVE-2026-111793 is an incorrect resource transfer vulnerability in Openwave Messaging Webtop Media Transcoder that permits authenticated users to process unintended document types. Both issues received patches in August and October 2026 respectively, yet exploitation continues. Cisco previously disclosed separate actively exploited flaws in Catalyst SD-WAN and Secure Firewall ASA/FTD products. Federal Civilian Executive Branch agencies must apply mitigations by November 24, 2026.

The Hacker NewsTranslated from English

Read at source

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in real-world attacks.

Details of the vulnerabilities are as follows:

  • CVE-2026-20320 (CVSS score: 7.5) – An improper restriction of XML external entity reference vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system with the privileges of the Cisco BroadWorks user. The issue was fixed in August 2026.
  • CVE-2026-111793 (CVSS score: 4.3) – An incorrect resource transfer between spheres vulnerability in Openwave Messaging Webtop Media Transcoder that could allow an authenticated user to process and convert unintended document types by bypassing the Webmail experience. The issue was fixed in October 2026.

There are currently no public details on how the vulnerabilities are being exploited in real-world attacks, nor have they been attributed to a specific named threat actor or group. Cisco’s advisory also makes no mention of the flaws being maliciously used.

Late last month, Cisco revealed that two different vulnerabilities in Catalyst SD-WAN (CVE-2026-20127, CVSS score: 10.0) and Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software (CVE-2026-76418, CVSS score: 8.6) have been actively exploited in the wild.

In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 24, 2026, to secure their networks.

Catalyst SD-WANCVE-2026-20320Cisco BroadWorksOpenwave MessagingCVE-2026-111793
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data
Vulns & Exploits

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers. The Openwave flaw, tracked as CVE-2026-111793, allows authenticated users to bypass file-type restrictions and convert unintended documents, potentially leading to sensitive data exposure. Patched in version 1.1.22.0 released in December 2021, the issue was added to CISA’s Known Exploited Vulnerabilities catalog on November 10. The Cisco BroadWorks vulnerability, CVE-2026-20320, is an unauthenticated blind XML external entity injection that enables remote attackers to read sensitive configuration data via the OCI-P service. Malbear Labs reported that a Chinese-speaking actor used an autonomous AI intrusion harness to target a European telecom provider and at least 13 of its customers, focusing on asset enumeration, credential theft, and subscriber record harvesting. CISA added both flaws to the KEV list with a November 24 patching deadline for federal agencies.

SecurityWeekNov 11, 2026Translated from English

Microsoft Fixes Exchange Sign-Ins Broken by October 2026 Windows Server Updates
Vulns & Exploits

Microsoft Fixes Exchange Sign-Ins Broken by October 2026 Windows Server Updates

Microsoft has resolved Outlook sign-in and mail delivery problems affecting on-premises Exchange Server systems after the installation of the October 2026 Windows Server security updates. The issues impacted systems running Windows Server 2019 and later, causing users to be unable to sign in to Outlook on the web or send emails that remained stuck in the Outbox. Microsoft traced the root cause to a new default memory limit imposed on the Endpoint Mapper when processing Endpoint Lookup calls. The company confirmed that the November 2026 Patch Tuesday updates KB5131080 and KB5131090 fully address the known issue. A temporary registry-based workaround was also provided for administrators unable to deploy the cumulative updates immediately. Microsoft emphasized that the problems were unrelated to the October 2026 Exchange Server security updates themselves.

BleepingComputerNov 11, 2026Translated from English

Intel and AMD Release Over 50 Advisories Fixing More Than 200 Vulnerabilities
Vulns & Exploits

Intel and AMD Release Over 50 Advisories Fixing More Than 200 Vulnerabilities

Intel and AMD have published more than 50 new security advisories describing over 200 vulnerabilities across their product lines. Intel issued 24 advisories covering just over 100 flaws, including three rated critical and 20 rated high severity, with the largest advisory addressing 30 issues in the TDX Migration Trust Domain reference software. AMD released 29 security bulletins and two briefs covering roughly 100 unique CVEs, none rated critical, though many mitigations were issued months or years earlier while others remain scheduled as late as 2027. Several high-severity issues affect graphics products, UEFI firmware, Secure Encrypted Virtualization, and management tools, with some tied to academic research on transient execution attacks. Intel has discontinued one affected product and advises immediate uninstallation, while AMD continues to coordinate fixes for firmware and processor components. The volume of disclosures highlights ongoing challenges in securing complex hardware and firmware ecosystems used in servers, workstations, and consumer devices.

SecurityWeekNov 11, 2026Translated from English