Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers. The Openwave flaw, tracked as CVE-2026-111793, allows authenticated users to bypass file-type restrictions and convert unintended documents, potentially leading to sensitive data exposure. Patched in version 1.1.22.0 released in December 2021, the issue was added to CISA’s Known Exploited Vulnerabilities catalog on November 10. The Cisco BroadWorks vulnerability, CVE-2026-20320, is an unauthenticated blind XML external entity injection that enables remote attackers to read sensitive configuration data via the OCI-P service. Malbear Labs reported that a Chinese-speaking actor used an autonomous AI intrusion harness to target a European telecom provider and at least 13 of its customers, focusing on asset enumeration, credential theft, and subscriber record harvesting. CISA added both flaws to the KEV list with a November 24 patching deadline for federal agencies.

SecurityWeekNovember 11, 2026Translated from English

Read at source

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers and their customers.

Openwave Messaging provides email and messaging platforms, including webmail, to communication service providers. The Webtop Media Transcoder component handles document conversion and is tied to the company’s webmail service. The vulnerability, tracked as CVE-2026-111793, exists because administrator-defined file-type restrictions are not enforced, allowing users to convert unintended file types.

“This may allow an authenticated user to process and convert unintended document types if bypassing the webmail experience,” Openwave Messaging explains in its advisory. Webtop Media Transcoder version 1.1.22.0, released in December 2021, contains the necessary patches. The flaw was disclosed on October 7, with the CVE record published on October 16. Japan JVN flagged the weakness as actively exploited on November 9, warning that an authenticated attacker could upload a specially crafted file and obtain sensitive information.

The Cisco BroadWorks vulnerability, tracked as CVE-2026-20320, was disclosed on August 19 as an out-of-band blind XML external entity injection. It can be exploited remotely without authentication to read sensitive configuration information. “This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service,” Cisco notes in its advisory.

Patches for the issue were included in version RI.2026.07 of BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. On November 8, Malbear Labs warned that a Chinese-speaking threat actor has been exploiting the vulnerability in a broad campaign that relied on an autonomous AI intrusion harness to target a European telecommunications provider and its customers.

At least 13 organizations using the telecom provider’s services may have been targeted. The campaign focused on asset enumeration, credential theft, and subscriber billing and device records harvesting. The US cybersecurity agency CISA added the Openwave and Cisco security defects to its Known Exploited Vulnerabilities (KEV) catalog on November 10, urging federal agencies to patch both by November 24.

CVE-2026-20320 Cisco BroadWorks CVE-2026-111793 Openwave Malbear Labs

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV Catalog After Active Exploitation in Telecom Attacks

The US Cybersecurity and Infrastructure Security Agency has added the high-severity Cisco BroadWorks vulnerability CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. The flaw stems from improper XML External Entity parsing in the Open Client Interface XML Parser, allowing unauthenticated remote attackers to read sensitive configuration files. Cisco patched the issue in August, but threat actors have since weaponized it against a European telecommunications provider and thirteen downstream organizations. Intelligence from Malbear Labs reveals the attack leveraged a jailbroken DeepSeek Flash AI model to exploit the BroadWorks XSP platform and extract private keys from the Provisioning Server. CISA has mandated federal agencies to remediate by November 24 under BOD 26-04 while urging all organizations to prioritize patching. This marks the 103rd Cisco vulnerability added to the KEV list since 2021.

BleepingComputerNov 11, 2026Translated from English

Vulns & Exploits

Microsoft Fixes Exchange Sign-Ins Broken by October 2026 Windows Server Updates

Microsoft has resolved Outlook sign-in and mail delivery problems affecting on-premises Exchange Server systems after the installation of the October 2026 Windows Server security updates. The issues impacted systems running Windows Server 2019 and later, causing users to be unable to sign in to Outlook on the web or send emails that remained stuck in the Outbox. Microsoft traced the root cause to a new default memory limit imposed on the Endpoint Mapper when processing Endpoint Lookup calls. The company confirmed that the November 2026 Patch Tuesday updates KB5131080 and KB5131090 fully address the known issue. A temporary registry-based workaround was also provided for administrators unable to deploy the cumulative updates immediately. Microsoft emphasized that the problems were unrelated to the October 2026 Exchange Server security updates themselves.

BleepingComputerNov 11, 2026Translated from English

Vulns & Exploits

Intel and AMD Release Over 50 Advisories Fixing More Than 200 Vulnerabilities

Intel and AMD have published more than 50 new security advisories describing over 200 vulnerabilities across their product lines. Intel issued 24 advisories covering just over 100 flaws, including three rated critical and 20 rated high severity, with the largest advisory addressing 30 issues in the TDX Migration Trust Domain reference software. AMD released 29 security bulletins and two briefs covering roughly 100 unique CVEs, none rated critical, though many mitigations were issued months or years earlier while others remain scheduled as late as 2027. Several high-severity issues affect graphics products, UEFI firmware, Secure Encrypted Virtualization, and management tools, with some tied to academic research on transient execution attacks. Intel has discontinued one affected product and advises immediate uninstallation, while AMD continues to coordinate fixes for firmware and processor components. The volume of disclosures highlights ongoing challenges in securing complex hardware and firmware ecosystems used in servers, workstations, and consumer devices.

SecurityWeekNov 11, 2026Translated from English