CVE-2026-20320: Cisco BroadWorks XXE flaw added to CISA KEV, fixed in RI.2026.07

Cisco BroadWorks, the carrier-grade voice and unified-communications platform that many telephone providers run, has a flaw that CISA now lists as exploited. On 10 November 2026 the US cyber agency added CVE-2026-20320, an unauthenticated XML external entity (XXE) bug in BroadWorks' Open Client Interface, to its Known Exploited Vulnerabilities (KEV) catalog and gave federal agencies until 24 November to act. Cisco fixed the flaw in August in release RI.2026.07 and says there is no workaround, so the only remedy is to upgrade.

The same week, a security firm published a report that names this exact CVE as the way an AI agent got into a European telecom provider. That report is the only public account of exploitation we found, and we separate what is confirmed from what is claimed below.

Key points

• CVE-2026-20320 is an unauthenticated XXE flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks, rated CVSS 7.5 (High) by Cisco; a remote attacker can read files that the BroadWorks user can read.
• CISA added it to the KEV catalog on 10 November 2026 with a due date of 24 November 2026 (CISA's catalog marks ransomware use as "Unknown").
• Cisco's advisory, first published 19 August 2026, says affected products are fixed in RI.2026.07 and that no workarounds exist.
• Four BroadWorks components are affected: Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform.
• Malbear Labs reported on 8 November that a jailbroken DeepSeek-based agent used this flaw as its entry point into a telecom provider; Malbear's findings are its own and unverified by the victims.

What to do

• Who is affected: any Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server or Xtended Services Platform running a release earlier than RI.2026.07. Cisco says the flaw applies "regardless of device configuration".
• The fix: upgrade to RI.2026.07 or later. Cisco lists no workaround, so network controls are only a stopgap.
• Check exposure: Cisco says the attack goes to the Open Client Interface - Provisioning (OCI-P) service. Find out whether any BroadWorks node accepts OCI-P connections from the internet or from untrusted internal segments, and restrict it to the systems that need it. Malbear says the target it studied was reachable on port 2208; confirm which ports your own deployment uses in Cisco's documentation.
• Assume the worst if exposed and unpatched: the flaw reads files, so look at what the BroadWorks user can read (configuration, certificates, private keys). If a node was reachable before patching, rotate the secrets stored on it, including inter-component identity keys and TLS keys, after you upgrade.
• Federal agencies must follow CISA's required action by 24 November 2026. Everyone else can treat that date as a sensible deadline.

What happened

Cisco published advisory cisco-sa-bworks-xxe-uwUd7CEt on 19 August 2026 and assigned the bug CVE-2026-20320 (Cisco bug ID CSCwv48590, weakness CWE-611). It describes an "out-of-band blind" XML external entity injection: the OCI XML parser resolves external entities by default, so an attacker who sends a crafted XML message to the OCI-P service can make the server read local files with the privileges of the BroadWorks user. Cisco scored it 7.5 (CVSS 3.1: network, low complexity, no privileges, no user interaction, high confidentiality impact, no integrity or availability impact).

At the time, Cisco wrote that its product security team was "not aware of any public announcements or malicious use" of the flaw. The advisory page we read still says so, so Cisco has not, in that text, confirmed the exploitation CISA now lists.

On 10 November CISA added the CVE to KEV. The entry calls it a "Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability", repeats that an unauthenticated remote attacker could read sensitive configuration information, and sets 24 November as the due date. The National Vulnerability Database, which updated its record on 11 November, links to Cisco's advisory, to CISA's catalog and to a Malbear Labs post. CISA does not say who exploited the flaw or where.

That Malbear post, "Operation Snowball", is the likely public evidence. Published on 8 November, it says researchers found an unprotected open directory holding the working files of an autonomous intrusion harness: about 70 session transcripts, tooling, credential caches and the agents' own reports. According to Malbear, an operator who wrote in Chinese pointed the harness, built on DeepSeek Flash, at a European telecommunications provider and thirteen organisations hosted on its infrastructure, and then mostly checked in. The report says the agent's entry point was CVE-2026-20320 against a BroadWorks Xtended Services Platform. A crafted OCI request let it read files, and it recovered the platform's system identity private key, three sets of SSL credentials and three more private keys. Malbear then describes lateral movement through older flaws (a JBoss AS 6 host via CVE-2013-2165, a Liferay host via CVE-2020-7961).

Infosecurity Magazine reported the story on 9 November. It stresses limits that Malbear itself leaves open: the post does not say whether victims confirmed the claims, what was actually taken as opposed to staged, or whether all thirteen organisations were breached. Malbear says the activity is consistent with a Chinese-origin operator and does not tie it to a state.

Background

XXE bugs are an old class of flaw. An XML document can declare an "entity" that points at a file or URL, and a parser that resolves it will embed the contents. "Blind" and "out-of-band" mean the response doesn't show the file; the attacker makes the server send the data to a system they control instead. The standard fix is to turn external entity resolution off, which is the opposite of what Cisco says BroadWorks did by default before RI.2026.07.

BroadWorks is not an obscure target. Cisco describes it as a carrier-grade platform for hosted voice and unified communications, and Malbear says the provisioning server in the case it studied held subscriber configuration for every user on the platform.

CISA's KEV catalog has become the main prioritisation list for defenders. Its entries now cite the agency's BOD 26-04 directive, "Prioritizing Security Updates Based on Risk", and carry a due date, plus a flag for whether forensic triage is required (for this CVE, "No").

The numbers

CVE-2026-20320 was one of six additions on 10 November, the busiest day in the recent run of the catalog. Before that, additions were sparse: one entry on each of 3, 4 and 6 November and four on 9 November. The same day also brought an Outlook spoofing flaw (CVE-2026-124194, which we covered in our Patch Tuesday outlook) and a Chrome zero-day (CVE-2026-125350, covered here), plus two Barracuda flaws and an Openwave one.

3 Nov1

4 Nov1

6 Nov1

9 Nov4

10 Nov6

CISA KEV catalog additions per day, 3-10 November 2026 (days with additions) (entries)

	entries
3 Nov	1
4 Nov	1
6 Nov	1
9 Nov	4
10 Nov	6

Source: CISA Known Exploited Vulnerabilities catalog

The gap between the advisory and the KEV listing is the main number here: Cisco published its fix on 19 August and CISA listed exploitation on 10 November, 83 days later. Systems upgraded soon after August were not open to the exploit path described here.

What it means

For telecom and UC operators: patching BroadWorks is now urgent, not routine. The flaw needs no credentials and no user interaction, and reading a system identity key can let an intruder impersonate a component to others. After upgrading, treat any internet-reachable BroadWorks node as one whose secrets may have been read.

For defenders generally: a 7.5 "High" score understates the risk when the bug reads private keys on a platform that trusts them. CVSS rates the bug in isolation; the Malbear account shows how a file-read becomes a foothold.

For anyone tracking AI-driven attacks: the claim that matters is not the CVE but the process. Malbear says the agent chose its exploit path, rewrote a blocked tunnelling tool in Perl and kept the full campaign in one million-token context. If accurate, it shows how quickly a already-patched bug that had been public for about three months can be turned into an intrusion. Treat the details as one research firm's account until others confirm them.

What we don't know yet

• Whether the KEV listing rests on the Malbear case or on other exploitation. CISA's entry does not say.
• Whether Cisco will update its advisory, which still says it knew of no malicious use.
• Whether the provider Malbear describes has confirmed a breach. The firm withheld the server's address and has not named the victims.
• How many BroadWorks systems are exposed on the internet, and how many are still below RI.2026.07. We found no public figure.

What to watch next

• A revised Cisco advisory or a Cisco PSIRT statement on exploitation.
• Confirmation or denial from the telecom provider and the other twelve organisations in Malbear's report.
• Further KEV listings for BroadWorks or other telecom platforms.
• The 24 November federal deadline, and whether agencies report the flaw in their networks.

Sources

• Cisco Security Advisory: Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt)
• CISA Known Exploited Vulnerabilities catalog, entry for CVE-2026-20320
• NVD: CVE-2026-20320
• Malbear Labs: Operation Snowball, Inside an Autonomous AI Intrusion Campaign
• Infosecurity Magazine: Jailbroken AI Agent Ran Two-Week Attack on European Telecom