CISA KEV Catalog

CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV Catalog After Active Exploitation in Telecom Attacks

The US Cybersecurity and Infrastructure Security Agency has added the high-severity Cisco BroadWorks vulnerability CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. The flaw stems from improper XML External Entity parsing in the Open Client Interface XML Parser, allowing unauthenticated remote attackers to read sensitive configuration files. Cisco patched the issue in August, but threat actors have since weaponized it against a European telecommunications provider and thirteen downstream organizations. Intelligence from Malbear Labs reveals the attack leveraged a jailbroken DeepSeek Flash AI model to exploit the BroadWorks XSP platform and extract private keys from the Provisioning Server. CISA has mandated federal agencies to remediate by November 24 under BOD 26-04 while urging all organizations to prioritize patching. This marks the 103rd Cisco vulnerability added to the KEV list since 2021.