CISA flags Cisco BroadWorks flaw as actively exploited in attacks
Unauthenticated XXE CVE-2026-20320 lets attackers read BroadWorks files; FCEB agencies must remediate by November 24.
CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog after warning that attackers are exploiting the high-severity Cisco BroadWorks flaw. The bug is an XML External Entity weakness in the Open Client Interface parser that lets unauthenticated remote attackers read sensitive configuration with crafted XML. Cisco patched it in August. Federal civilian agencies must secure systems by November 24 under BOD 26-04.
Unconfirmed: CISA did not detail the attackers; Malbear Labs' attribution and AI-assisted exploitation claims are not confirmed by CISA.
- Cisco patched the OCI XML parser flaw in August.
- Malbear Labs says a Chinese-speaking actor used jailbroken DeepSeek Flash.
- The reported campaign hit a European telecom and 13 organizations using its infrastructure.
- Crafted OCI requests to port 2208 read files and yielded private keys.
- Since November 2021, CISA has listed 103 exploited Cisco flaws.
Impact: Unauthenticated remote read of configuration files and private keys
| Product | Affected |
|---|---|
| Cisco BroadWorks | — |
- 1.Patch Cisco BroadWorks systems affected by CVE-2026-20320.
- 2.Federal civilian agencies must remediate by November 24.
- CVEs
- CVE-2026-20320
- Vendors
- Cisco
- Products
- BroadWorks
- Organizations
- CISAMalbear Labs
- AI models
- DeepSeek Flash
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20320 | Unauthenticated XXE File Read in Cisco BroadWorks OCI-P Service | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.