Cisco BroadWorks RI.2026.07 Fixes CVE-2026-20320 Actively Exploited XXE Vulnerability
Do Son 
TL;DR
On November 10, 2026, CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalog due to live attacks. This Cisco BroadWorks XXE flaw lets remote foes read private files with no login. Teams must patch to release RI.2026.07 right away.
- CVE: CVE-2026-20320
- CVSS: 7.5 (High · CVSSv3)
- Product: Cisco BroadWorks
- Affected: N/A
- Impact: CWE-611
- Status: Exploited in the wild
- EPSS: 0.8% (30-day)
- Action: See vendor advisory
Why It Matters
Phone firms and voice hosts run cloud calls on Cisco BroadWorks. Therefore, a remote file-read bug puts core network data at risk. Sandesh M Gawai first found and sent this bug to Cisco in August 2026. Later, Cisco updated its security advisory on November 12, 2026. In that post, Cisco confirmed live attacks in the wild. However, neither Cisco nor CISA confirms any public exploit code yet. Still, CISA gave federal teams until November 24, 2026, to patch CVE-2026-20320.
How the Attack Works
XML Parser Flaw
Tracked as Bug ID CSCwv48590, this Cisco BroadWorks XXE bug holds a 7.5 CVSS score. Cisco states, “A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.”
Specifically, the XML parser fails to block external entities. Cisco notes, “This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default.” Next, a threat actor sends a crafted XML message to the OCI-P port. As a result, the host leaks local files with BroadWorks user rights. Foes can then steal keys or passwords from those files.
Affected Versions
Vulnerable BroadWorks Software
Builds older than RI.2026.07 face risk across four Cisco BroadWorks tools, regardless of setup. Cisco confirmed no other tools face impact.
- BroadWorks Application Delivery Platform (OCS and OCIOverSoap)
- BroadWorks Application Server
- BroadWorks Profile Server
- BroadWorks Xtended Services Platform
Patch and Mitigation Steps
Sadly, admins cannot stop this Cisco BroadWorks XXE bug with config rules. Cisco warns, “There are no workarounds that address this vulnerability.” Thus, teams must upgrade all vulnerable hosts to release RI.2026.07 or newer. Afterward, staff should check OCI-P logs and rotate stored keys. Fast action keeps voice networks safe from data theft.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
