CISA adds Cisco BroadWorks XXE flaw to KEV (CVE-2026-20320)
Original title: CISA KEV: Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability — Cisco BroadWorks (CVE-2026-20320)
An unauthenticated remote attacker can read sensitive configuration; the federal remediation due date is November 24.
CISA added CVE-2026-20320, an XML external entity flaw in Cisco BroadWorks, to the Known Exploited Vulnerabilities catalog. An unauthenticated remote attacker could read sensitive configuration information on an affected system. The required-action due date is November 24. CISA lists known ransomware campaign use as unknown and directs agencies to vendor mitigations under BOD 26-04.
Unconfirmed: CISA marks known ransomware campaign use as unknown.
- The flaw is improper restriction of XML external entity references.
- No affected or fixed BroadWorks version is stated.
- Agencies must also follow CISA forensics triage requirements.
- Use must stop if mitigations are unavailable.
Impact: unauthenticated remote read of sensitive configuration
| Product | Affected |
|---|---|
| Cisco BroadWorks | — |
- 1.Apply vendor mitigations under CISA BOD 26-04 guidance.
- 2.Discontinue use if mitigations are unavailable.
- 3.Complete required action by November 24.
- CVEs
- CVE-2026-20320
- Vendors
- Cisco
- Products
- BroadWorks
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20320 | Unauthenticated XXE File Read in Cisco BroadWorks OCI-P Service | 7.5 | <1% | KEVPoC | KEV |
From the original article
1 min read at cisa.govCisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.