CISA Flags Cisco BroadWorks Flaw as Actively Exploited

The US Cybersecurity and Infrastructure Security Agency (CISA) says attackers are exploiting a high-severity vulnerability in Cisco BroadWorks, a cloud communications platform used by telecom carriers and service providers.

Tracked as CVE-2026-20320, the flaw affects the Open Client Interface (OCI) XML Parser. Cisco said it stems from XML entries being parsed with external entity resolution enabled by default. An unauthenticated remote attacker could send a crafted XML message to the OCI Provisioning service and read sensitive configuration information from a vulnerable system. Cisco patched the flaw in August.

CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and directed federal civilian agencies to secure affected systems by November 24, within two weeks. The deadline follows Binding Operational Directive 26-04. CISA also urged private-sector security teams to prioritize patching, while noting that the directive applies only to federal agencies.

CISA did not provide details about the attacks. Malbear Labs reported over the weekend that a Chinese-speaking threat actor used the flaw against a European telecom provider and 13 organizations using its data centers and cloud infrastructure. The report said the activity targeted the provider's BroadWorks XSP and that the Provisioning Server was also exposed through an unauthenticated directory listing.

Since November 2021, CISA has added 103 Cisco vulnerabilities to its exploited-flaws list; seven were also abused by ransomware gangs.