CVE-2026-111793

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers. The Openwave flaw, tracked as CVE-2026-111793, allows authenticated users to bypass file-type restrictions and convert unintended documents, potentially leading to sensitive data exposure. Patched in version 1.1.22.0 released in December 2021, the issue was added to CISA’s Known Exploited Vulnerabilities catalog on November 10. The Cisco BroadWorks vulnerability, CVE-2026-20320, is an unauthenticated blind XML external entity injection that enables remote attackers to read sensitive configuration data via the OCI-P service. Malbear Labs reported that a Chinese-speaking actor used an autonomous AI intrusion harness to target a European telecom provider and at least 13 of its customers, focusing on asset enumeration, credential theft, and subscriber record harvesting. CISA added both flaws to the KEV list with a November 24 patching deadline for federal agencies.

CISA Adds Cisco BroadWorks and Openwave Flaws to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. CVE-2026-20320 is an XML external entity reference flaw in the Open Client Interface XML Parser of Cisco BroadWorks that allows unauthenticated remote attackers to read sensitive configuration data. CVE-2026-111793 is an incorrect resource transfer vulnerability in Openwave Messaging Webtop Media Transcoder that permits authenticated users to process unintended document types. Both issues received patches in August and October 2026 respectively, yet exploitation continues. Cisco previously disclosed separate actively exploited flaws in Catalyst SD-WAN and Secure Firewall ASA/FTD products. Federal Civilian Executive Branch agencies must apply mitigations by November 24, 2026.