CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV Catalog After Active Exploitation in Telecom Attacks

The US Cybersecurity and Infrastructure Security Agency has added the high-severity Cisco BroadWorks vulnerability CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. The flaw stems from improper XML External Entity parsing in the Open Client Interface XML Parser, allowing unauthenticated remote attackers to read sensitive configuration files. Cisco patched the issue in August, but threat actors have since weaponized it against a European telecommunications provider and thirteen downstream organizations. Intelligence from Malbear Labs reveals the attack leveraged a jailbroken DeepSeek Flash AI model to exploit the BroadWorks XSP platform and extract private keys from the Provisioning Server. CISA has mandated federal agencies to remediate by November 24 under BOD 26-04 while urging all organizations to prioritize patching. This marks the 103rd Cisco vulnerability added to the KEV list since 2021.

BleepingComputerNovember 11, 2026Translated from English

Read at source

The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. Cisco BroadWorks is a cloud unified communications (UC) software platform and the underlying engine allowing telecom carriers and managed service providers (MSPs) to provide branded cloud PBX, voice, and collaboration services to business customers.

Tracked as CVE-2026-20320, the security flaw stems from an improper restriction of XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML Parser that can allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending maliciously crafted XML messages.

"This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.

CISA flagged CVE-2026-20320 as actively exploited and added it to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems within two weeks, by November 24, as mandated by Binding Operational Directive (BOD) 26-04.

Although BOD 26-04 targets only federal agencies, CISA urged all security teams, including those in the private sector, to prioritize patches for this vulnerability to defend their networks against ongoing attacks.

Targeted in autonomous AI attack While CISA didn't share more details on attackers exploiting CVE-2026-20320 in the wild, threat intelligence firm Malbear Labs said over the weekend that a Chinese-speaking threat actor has exploited the flaw with the help of a jailbroken DeepSeek Flash artificial intelligence model in attacks targeting a European telecommunications provider and thirteen organizations that used its data centers and cloud infrastructure.

The attack focused on the telecom provider's BroadWorks XSP (eXtended Services Platform), and Malbear Labs found that the BroadWorks Provisioning Server (which stores subscriber configuration for all users) was also exposed via an unauthenticated directory listing.

"The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser. A crafted OCI request to port 2208 causes the XML parser to read arbitrary files from the server filesystem and no prior authentication required," Malbear Labs said.

CVE-2026-20320 Cisco BroadWorks Malbear Labs DeepSeek Flash CISA KEV Catalog

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

ICS Patch Tuesday: Siemens, Schneider Electric Disclose High-Severity Vulnerabilities and Node2Shell Exposure

Siemens has released nine new security advisories covering ten vulnerabilities across multiple industrial products, including high-severity issues in ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA, PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. Two of the advisories address the impact of the Node2Shell vulnerability, with exploitation attempts already observed in the wild though no targeted attacks against Siemens products have been confirmed. Schneider Electric published one advisory for a medium-severity flaw in EcoStruxure Power Build Rapsody that could enable arbitrary code execution via malicious files. Germany’s VDE CERT issued eight advisories affecting Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec products, many involving third-party components such as PHP2Shell. Phoenix Contact, Johnson Controls, and Hitachi Energy also released advisories detailing risks in PLCnext, EasyIO Neo IO Manager, C•CURE 9000, and other systems, with some products lacking available patches.

SecurityWeekNov 11, 2026Translated from English

Vulns & Exploits

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers. The Openwave flaw, tracked as CVE-2026-111793, allows authenticated users to bypass file-type restrictions and convert unintended documents, potentially leading to sensitive data exposure. Patched in version 1.1.22.0 released in December 2021, the issue was added to CISA’s Known Exploited Vulnerabilities catalog on November 10. The Cisco BroadWorks vulnerability, CVE-2026-20320, is an unauthenticated blind XML external entity injection that enables remote attackers to read sensitive configuration data via the OCI-P service. Malbear Labs reported that a Chinese-speaking actor used an autonomous AI intrusion harness to target a European telecom provider and at least 13 of its customers, focusing on asset enumeration, credential theft, and subscriber record harvesting. CISA added both flaws to the KEV list with a November 24 patching deadline for federal agencies.

SecurityWeekNov 11, 2026Translated from English

Vulns & Exploits

Microsoft Fixes Exchange Sign-Ins Broken by October 2026 Windows Server Updates

Microsoft has resolved Outlook sign-in and mail delivery problems affecting on-premises Exchange Server systems after the installation of the October 2026 Windows Server security updates. The issues impacted systems running Windows Server 2019 and later, causing users to be unable to sign in to Outlook on the web or send emails that remained stuck in the Outbox. Microsoft traced the root cause to a new default memory limit imposed on the Endpoint Mapper when processing Endpoint Lookup calls. The company confirmed that the November 2026 Patch Tuesday updates KB5131080 and KB5131090 fully address the known issue. A temporary registry-based workaround was also provided for administrators unable to deploy the cumulative updates immediately. Microsoft emphasized that the problems were unrelated to the October 2026 Exchange Server security updates themselves.

BleepingComputerNov 11, 2026Translated from English