Attackers exploit Openwave and Cisco BroadWorks flaws added to KEV
Original title: Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities
CISA told federal agencies to patch CVE-2026-111793 and CVE-2026-20320 by November 24 after confirmed exploitation.
Attackers are exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks to obtain sensitive information. Japan’s JVN said an authenticated attacker can upload a crafted file through the Openwave bug, fixed in version 1.1.22.0. Cisco’s flaw is an unauthenticated blind XML external entity injection against the OCI-P service, patched in BroadWorks RI.2026.07. Malbear Labs says a Chinese-speaking actor used an autonomous AI intrusion harness against a European telecom provider. CISA added both defects to the KEV catalog on November 10.
Unconfirmed: Malbear Labs’ claim of a Chinese-speaking actor and that at least 13 organizations may have been targeted is not independently confirmed here.
- Openwave disclosed the transcoder bug on October 7; the CVE was published October 16.
- JVN flagged CVE-2026-111793 as exploited on November 9.
- Malbear Labs warned on November 8 that at least 13 customer organizations may have been targeted.
- The campaign sought credentials plus subscriber billing and device records.
- Federal agencies were urged to patch both flaws by November 24.
Impact: Read sensitive configuration and other sensitive information
| Product | Affected | Fixed in |
|---|---|---|
| Openwave Messaging Webtop Media Transcoder | — | 1.1.22.0 |
| Cisco BroadWorks | — | RI.2026.07 |
- 1.Install Webtop Media Transcoder 1.1.22.0.
- 2.Update affected BroadWorks components to RI.2026.07.
- 3.US federal agencies should patch both flaws by November 24.
- Vendors
- Openwave MessagingCisco
- Organizations
- CISAMalbear Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111793 | File-type restriction bypass in Openwave Webtop Media Transcoder | 4.3 | <1% | KEV | KEV |
| CVE-2026-20320 | Unauthenticated XXE File Read in Cisco BroadWorks OCI-P Service | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at securityweek.com
The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data. The post Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.