Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-20320 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Cisco |
| Product | BroadWorks |
| Vulnerability Type | XML External Entity, XXE (CWE-611) |
| CVSS Score | 7.5 (high) |
| EPSS Score | 0.4% (percentile: 33%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-11-24 |
Vulnerability Description
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
CISA has added the flaw to the KEV catalog, confirming active exploitation, and set a remediation deadline of November 24, 2026 for US federal agencies.
Required Actions
- Apply the fixes from Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt on BroadWorks servers (Application Server, Profile Server, Xtended Services Platform, Application Delivery Platform).
- Restrict access to the OCI-P service to trusted provisioning systems.
- Exposed files may contain passwords and keys — after updating, consider rotating credentials stored in the BroadWorks configuration.
Who Is Affected?
The vulnerability affects the Cisco BroadWorks platform (including Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform). BroadWorks is a cloud telephony and UCaaS platform used mainly by telecom operators and voice service providers.
Sources
- NVD - CVE-2026-20320
- Cisco Security Advisory cisco-sa-bworks-xxe-uwUd7CEt
- CISA KEV Catalog
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-20320 vulnerability?
CVE-2026-20320 is an XML External Entity (XXE, CWE-611) flaw in the OCI XML parser of Cisco BroadWorks that allows reading sensitive configuration files. CVSS score: 7.5; the flaw is listed in the CISA KEV catalog.
Does exploiting CVE-2026-20320 require authentication?
No. Sending a crafted XML message to the OCI-P service is enough; the attack requires no authentication.
How to protect against CVE-2026-20320?
Apply the fixes from Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt, restrict access to OCI-P and consider rotating credentials. The CISA deadline is November 24, 2026.
Who is affected by CVE-2026-20320?
Telecom operators and voice service providers running Cisco BroadWorks, and indirectly their business customers.
