November 14, 2026

CVE Watchtower

CVE-2026-20320Cisco Broadworks Application Delivery Platform < ri.2026.07 XML External Entity (XXE) Reference

NVDCVSS scored by psirt@cisco.com

Vulnerability Summary

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
Severity Level
HIGH(7.5)
Published Date
Aug 19, 2026
Last Modified
Nov 13, 2026
Exploitation Status
ACTIVE
EPSS Score (30-Day)
0.98%Probability
Root Weakness (CWE)
CWE-611: XML External Entity (XXE) Reference ↗
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control.
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

Affected & Patched Versions

Affected Versions
  • Cisco Broadworks Application Delivery Platform < ri.2026.07
  • Cisco Broadworks Application Server < 2026.0
  • Cisco Broadworks Profile Server < 2026.07
  • Cisco Broadworks Xtended Services Platform < 2026.07
Patched Versions
  • Cisco Broadworks Application Delivery Platform ri.2026.07
  • Cisco Broadworks Application Server 2026.0
  • Cisco Broadworks Profile Server 2026.07
  • Cisco Broadworks Xtended Services Platform 2026.07

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Nov 24, 2026.

  1. Check whether you run Cisco Broadworks Application Delivery Platform < ri.2026.07 and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Nov 10, 2026
Remediation due: Nov 24, 2026

Timeline

  • Aug 19, 2026Published
  • Nov 10, 2026Added to CISA KEV catalog
  • Nov 13, 2026Record last modified
  • Nov 24, 2026KEV remediation due date

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Cisco CVEsYou are reading CVE-2026-20320. Get an email when KEV listings, exploits or new CVEs match your stack.
Notify me about Cisco CVEs

Related Coverage

All Cisco vulnerabilities →

External References

Data last checked: Nov 14, 2026 06:31 UTC