Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

CISA Adds Cisco BroadWorks and Openwave Flaws to KEV Catalog

Breaking news 5 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

TL;DR - CISA added CVE-2026-20320 and CVE-2026-111793 to its Known Exploited Vulnerabilities Catalog on 2026-11-10. - Cisco BroadWorks CVE-2026-20320 has a CVSS Score of 7.5 and can expose sensitive configuration information. - Cisco lists fixed BroadWorks releases beginning with RI.2026.07 and says no workaround is available. - CISA lists 2026-11-24 as the due date for both entries.

What happened#

CISA said it added six vulnerabilities to its Known Exploited Vulnerabilities Catalog on November 10, 2026, based on evidence of active exploitation. Two of the entries affect communications products: CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging Limited Webtop Media Transcoder. CISA’s alert

CVE-2026-20320 is an improper restriction of XML external entity reference vulnerability in Cisco BroadWorks. Cisco describes the issue as an out-of-band blind XML External Entity Injection Vulnerability in the Open Client Interface XML Parser. An unauthenticated, remote attacker could send a crafted XML message to the Open Client Interface, Provisioning service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user. Cisco’s advisory

Cisco rates the vulnerability High and gives it a CVSS Score of 7.5. Cisco first published its advisory on 2026 August 19 16:00 GMT. The advisory says software updates address the vulnerability and that no workarounds are available.

CISA describes CVE-2026-111793 as an incorrect resource transfer between spheres vulnerability in Openwave Messaging Limited Webtop Media Transcoder. It may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. CISA lists 2026-11-24 as the due date for the entry. CISA’s catalog

Are you affected#

Cisco says the vulnerability affects the following products when they are running a vulnerable release of Cisco BroadWorks, regardless of device configuration:

  • BroadWorks Application Delivery Platform
  • BroadWorks Application Server
  • BroadWorks Profile Server
  • BroadWorks Xtended Services Platform

For BroadWorks Application Delivery Platform releases earlier than RI.2026.07, Cisco lists RI.2026.07 as the first fixed release. The advisory lists RI.2026.07 as the first fixed release for BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform as well. For the Application Delivery Platform, Cisco notes that the fixed-release entry covers Open Client Server and OCIOverSoap.

Organizations should compare deployed BroadWorks products and releases with Cisco’s affected and fixed release information. The available material does not identify which particular deployments have been exploited.

CISA’s catalog identifies CVE-2026-20320 as affecting Cisco BroadWorks and CVE-2026-111793 as affecting Openwave Messaging Limited Webtop Media Transcoder. CISA lists “Known To Be Used in Ransomware Campaigns?” as Unknown for both entries and “Forensic triage required per BOD 26-04” as No for both.

What is confirmed and what is reported#

Claim Source Status
CVE-2026-20320 affects Cisco BroadWorks and could allow an unauthenticated, remote attacker to read sensitive configuration information. CISA Confirmed
Cisco BroadWorks CVE-2026-20320 has a CVSS Score of 7.5. Cisco Confirmed
Cisco has released updates addressing CVE-2026-20320, with RI.2026.07 listed as the first fixed release for the affected BroadWorks products. Cisco Confirmed
No workarounds are available for the Cisco BroadWorks vulnerability. Cisco Confirmed
CISA added CVE-2026-20320 and CVE-2026-111793 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CISA Confirmed
CVE-2026-111793 may allow an authenticated user to process and convert unintended document types when bypassing the Webmail experience. CISA Confirmed
There are no published details on how either vulnerability is being exploited in real-world attacks, and no specific threat actor or group has been named. The Hacker News Reported
Cisco’s advisory does not mention malicious use of CVE-2026-20320. The Hacker News, Cisco Reported

What defenders should do now#

  1. Identify whether the organization operates BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, or BroadWorks Xtended Services Platform.

  2. Check the deployed BroadWorks releases against Cisco’s advisory. Cisco lists RI.2026.07 as the first fixed release for the affected products and recommends upgrading to the fixed software indicated in the advisory.

  3. Apply Cisco’s fixed software according to the organization’s change and availability procedures. Cisco says there are no workarounds that address the vulnerability.

  4. Review externally reachable BroadWorks services and determine whether the Open Client Interface, Provisioning service is exposed. Cisco identifies that service as the target for a crafted XML message.

  5. Prioritize CVE-2026-20320 and CVE-2026-111793 in vulnerability-management workflows because CISA added both to the Known Exploited Vulnerabilities Catalog. CISA encourages all organizations to prioritize KEV Catalog vulnerabilities using risk-based vulnerability management.

  6. Review relevant authentication, service, filesystem, and network logs for activity associated with the affected services. The available material does not provide attack indicators or a detailed exploitation procedure, so teams should use their normal incident-response processes.

  7. For federal civilian executive branch agencies, follow applicable BOD 26-04 requirements and CISA’s listed due dates. CISA lists 2026-11-24 for CVE-2026-20320 and CVE-2026-111793.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-11-11

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.