Cisco published security advisory cisco-sa-bworks-xxe-uwUd7CEt, "Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability," on 19 August 2026 for CVE-2026-20320, a flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks. Cisco rates the vulnerability High, with a CVSS 3.1 score of 7.5, and says an unauthenticated, remote attacker could read sensitive configuration information on an affected system. The first fixed release for the four listed BroadWorks products is RI.2026.07. Cisco lists no workaround.
CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on 10 November 2026, with a due date of 24 November 2026. That due date is CISA's. As of 11 November 2026 at 08:26 Asia/Jerusalem UTC+2, Cisco's advisory remains version 1.0, dated 19 August 2026, and still states that the Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability.
Technical Information
Cisco classifies CVE-2026-20320 as CWE-611, Improper Restriction of XML External Entity Reference. The advisory says XML entries are improperly parsed because external entity resolution is allowed by default. An attacker could send a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service. A successful exploit, Cisco says, could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
This is a confidentiality impact. Cisco's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: reachable over the network with no privileges or user interaction required, and with no integrity or availability impact in that score. NVD lists the record as Analyzed and republishes Cisco's 7.5 metric as type Secondary; NVD has not added a Primary score of its own. This advisory uses Cisco's score.
Cisco credits Sandesh M Gawai with reporting the vulnerability (Cisco bug CSCwv48590). The reviewed material does not publish the exact XML message format, and those details should not be inferred here.
Affected Product Versions
| Product | Affected releases | First fixed release | Cisco footnote |
|---|---|---|---|
| BroadWorks Application Delivery Platform | Earlier than RI.2026.07 | RI.2026.07 | Open Client Server (OCS) and OCIOverSoap |
| BroadWorks Application Server | Earlier than RI.2026.07 | RI.2026.07 | — |
| BroadWorks Profile Server | Earlier than RI.2026.07 | RI.2026.07 | — |
| BroadWorks Xtended Services Platform | Earlier than RI.2026.07 | RI.2026.07 | — |
Cisco says these products are affected if they are running a vulnerable release of Cisco BroadWorks, regardless of device configuration, and that only the products listed in the advisory are known to be affected.
This advisory follows Cisco's fixed-release tables. NVD's CPE configuration currently lists BroadWorks Application Server (release independent) as vulnerable in a range ending before 2026.0, which does not match Cisco's first fixed release of RI.2026.07 for that product. Operators should use Cisco's tables rather than that NVD range.
Exploitation and Public Proof-of-Concept Status
Cisco's advisory, rechecked on 11 November 2026 at 08:26 Asia/Jerusalem UTC+2, remains version 1.0 (initial public release, 19 August 2026) and still states that the Cisco PSIRT is not aware of any public announcements or malicious use. Cisco's portion of the CVE record carries the same language and has not been revised since 19 August 2026.
CISA added CVE-2026-20320 to the Known Exploited Vulnerabilities catalog on 10 November 2026 (catalogVersion 2026.11.10, checked 11 November 2026 at 08:26 Asia/Jerusalem UTC+2). CISA lists known ransomware campaign use as Unknown and sets forensic triage to No. CISA's 10 November 2026 alert said the six additions that day, including this CVE, were based on evidence of active exploitation; it did not describe that evidence, a technique, a victim or a threat actor.
The CVE record and NVD carry a CISA-ADP SSVC assessment dated 10 November 2026 with Exploitation set to active, Automatable yes, and Technical Impact partial. That is CISA-ADP's assessment, consistent with the catalog entry, not a separate incident report.
Malbear Labs, an independent research blog, reported on 8 November 2026 that CVE-2026-20320 was used against a BroadWorks Xtended Services Platform at an unnamed European telecommunications provider and that private keys and certificates were taken, based on files it says it found in an exposed attacker workspace. That claim is reported by Malbear Labs and has not been independently verified. Cisco has not confirmed it, and CISA has not said what evidence supported the KEV listing. This advisory does not adopt indicators or other claims from that post.
The Hacker News reported on 11 November 2026 that there were no public details on how the flaw is being exploited and no named threat actor, and that Cisco's advisory makes no mention of malicious use. A separate Openwave CVE added to KEV the same day is outside the scope of this advisory.
Workaround and Mitigation
Cisco lists no workarounds and strongly recommends that customers upgrade to the fixed software. The first fixed release for each of the four listed products is RI.2026.07. For Application Delivery Platform, Cisco footnotes Open Client Server (OCS) and OCIOverSoap on that row; administrators should confirm those components are on the fixed release rather than relying on a generic BroadWorks version string. After upgrading, retain evidence of the running release.
While arranging the upgrade, reviewing who can reach the OCI-P service and other BroadWorks provisioning interfaces is general exposure reduction, not a Cisco workaround, and should not be accepted as remediation closure.
Organizations that follow CISA's KEV catalog or BOD 26-04 should note CISA's due date of 24 November 2026. CISA's required action is to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance.
Indicators of Compromise
Cisco's advisory does not publish CVE-specific malicious IP addresses, domains, file hashes or detection signatures, and no indicator set should be imported from unverified third-party write-ups and treated as confirmed for this CVE.
Unexpected access to BroadWorks configuration, unexpected use of platform identity or TLS private keys, or unusual traffic to the OCI-P service can warrant investigation, but they are not validated signatures for CVE-2026-20320. Preserve relevant logs and follow established incident-response procedures. Updating the software does not establish whether prior unauthorized file access occurred.
What to Ask Your Carriers and Hosted-Calling Providers Today
Cisco BroadWorks is used by carriers and by hosted-calling and UCaaS providers to run voice services for their customers. Ask those suppliers whether they operate BroadWorks Application Delivery Platform, Application Server, Profile Server or Xtended Services Platform on a release earlier than RI.2026.07. Request the patch owner, planned completion time and evidence of RI.2026.07. For Application Delivery Platform, ask specifically about Open Client Server (OCS) and OCIOverSoap.
For deployments still awaiting the upgrade, ask which access restrictions are in place around the OCI-P service and whether configuration files, platform identity keys and certificate material are being reviewed. Keep those restrictions distinct from remediation, since Cisco provides no workaround. Track fixed-release evidence to closure, and do not treat Cisco's current "no known malicious use" wording as evidence that a given supplier's deployment was not reached.
Need help working through carriers or hosted-calling providers running BroadWorks? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- Cisco security advisory: BroadWorks out-of-band blind XXE — first published 19 August 2026 at 16:00 GMT (19:00 Asia/Jerusalem UTC+3); still version 1.0 Final as rechecked 11 November 2026 at 08:26 Asia/Jerusalem UTC+2; Cisco rating High, CVSS 3.1 7.5; no workarounds; first fixed release RI.2026.07; PSIRT not aware of public announcements or malicious use.
- Cisco-authored CVE-2026-20320 record — Cisco container unchanged since 19 August 2026; CISA-ADP SSVC (dated 10 November 2026) Exploitation active.
- CISA vulnerability catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z; CVE-2026-20320 added 2026-11-10, due 2026-11-24, known ransomware campaign use Unknown, forensic triage No. Checked 11 November 2026 at 08:26 Asia/Jerusalem UTC+2.
- CISA alert: six KEV additions, 10 November 2026
- NVD CVE-2026-20320 — Analyzed as of lastModified 2026-11-11T05:19:43.487Z; Cisco 7.5 metric republished as type Secondary, no NVD Primary score; Application Server CPE range ends before 2026.0. Checked 11 November 2026 at 08:26 Asia/Jerusalem UTC+2.
- The Hacker News report on the BroadWorks and Openwave KEV additions — 11 November 2026; secondary; no exploit-method or named-actor details.
- Malbear Labs, "Operation Snowball" — 8 November 2026; independent research blog; reported, not independently verified.
