CISA Adds Cisco BroadWorks XXE Flaw CVE-2026-20320 to KEV

CISA has added a Cisco BroadWorks XML external entity flaw, CVE-2026-20320, to its Known Exploited Vulnerabilities catalogue. The catalogue entry is dated 10 November 2026, in version 2026.11.10, with a due date of 24 November 2026. CISA says the vulnerability “could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.”

That CISA listing should not be silently merged with Cisco’s own, older wording. Cisco’s security advisory, first published on 19 August 2026 at 16:00 GMT as version 1.0 and still in that revision, states: “The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.” CISA’s decision to add the CVE to KEV is evidence that CISA now treats it as a known exploited vulnerability. It is not a new sentence from Cisco, and the August advisory has not been revised to report malicious use.

The Cisco BroadWorks flaw is an unauthenticated file-read, with a vendor fix

Cisco describes a vulnerability in the Open Client Interface XML parser of BroadWorks. Because external entity resolution is allowed by default, an unauthenticated, remote attacker could send a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service and, if successful, “view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.” Cisco rates the issue with a CVSS 3.1 base score of 7.5 and the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: reachable over the network, no privileges and no user interaction required, with a high confidentiality impact and no integrity or availability impact in that score.

The advisory lists four affected platform types, if they are running a vulnerable BroadWorks release, regardless of device configuration: BroadWorks Application Delivery Platform, BroadWorks Application Server, BroadWorks Profile Server, and BroadWorks Xtended Services Platform. For each, Cisco says releases earlier than RI.2026.07 are affected and that RI.2026.07 is the first fixed release. “There are no workarounds that address this vulnerability.” Cisco says it has released software updates that do address it, and it recommends upgrading to the fixed release.

CISA’s required action is to apply those vendor mitigations in line with Binding Operational Directive 26-04. Known ransomware campaign use is listed as Unknown. Forensic triage is listed as No. This article will not reproduce a payload or a step-by-step method for the XML message.

The same catalogue update is part of a broader 10 November KEV intake that also includes other recently covered exploited bugs, among them FreeSWITCH CVE-2026-116779 and IBM Aspera Faspex CVE-2026-123218. A closer cousin in mechanism, rather than in catalogue timing, is Cisco’s later patch for a Secure Email Gateway zero-day that attackers were already using. That earlier Cisco product is not BroadWorks, and the two advisories should not be flattened into one incident.

A KEV due date does not rewrite Cisco’s August sentence

The practical conflict for operators is how to read two official voices that are not saying the same thing about in-the-wild use. CISA’s catalogue is the federal list of vulnerabilities it has determined are known to be exploited. Cisco’s August v1.0 advisory is still the vendor document for affected products, fixed releases and workarounds, and it still says PSIRT is not aware of public announcements or malicious use. Both can be true in the narrow sense that they come from different dates and different organisations. Neither should be quoted as if it were the other.

The 24 November due date is, again, a deadline for Federal Civilian Executive Branch agencies under BOD 26-04. It is not a statutory deadline for every telecom operator or enterprise running BroadWorks. The reason to apply RI.2026.07, or a later fixed release, is that Cisco has already shipped a fix for an unauthenticated flaw that can expose sensitive configuration, and that CISA now lists the CVE as a known exploited vulnerability. Waiting for Cisco to edit the “not aware” sentence is not a substitute for installing the patch the same advisory already describes.

Operators should confine the work to the four listed platform types and to the fixed-release table in the advisory. Other BroadWorks components are not brought into scope by a catalogue headline. There are no workarounds to lean on in the meantime. The next federal marker is 24 November; the vendor action has been available since the August advisory.

Sources

1. CISA, Known Exploited Vulnerabilities Catalog, CVE-2026-20320, date added 10 November 2026, due date 24 November 2026, catalogue version 2026.11.10. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2. Cisco, “Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability,” advisory cisco-sa-bworks-xxe-uwUd7CEt, version 1.0, 19 August 2026, 16:00 GMT. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt

Related stories

CISA’s addition of FreeSWITCH CVE-2026-116779 to KEV is a recent example of the same catalogue process, with its own vendor fix and a separate due date.

Also relevant:

• CISA Adds IBM Aspera Faspex Flaw CVE-2026-123218 to KEV
• Cisco Patches a Secure Email Gateway Zero-Day That Attackers Are Already Using