CISA flags Cisco BroadWorks flaw as actively exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks.

Cisco BroadWorks is a cloud unified communications (UC) software platform and the underlying engine allowing telecom carriers and managed service providers (MSPs) to provide branded cloud PBX, voice, and collaboration services to business customers.

Tracked as CVE-2026-20320, the security flaw stems from an improper restriction of XML External Entity (XXE) reference weakness in the Open Client Interface (OCI) XML Parser that can allow unauthenticated, remote attackers to read sensitive configuration information from vulnerable systems by sending maliciously crafted XML messages.

"This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service," Cisco explained when it patched the bug in August.

CISA flagged CVE-2026-20320 as actively exploited and added it to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems within two weeks, by November 24, as mandated by Binding Operational Directive (BOD) 26-04.

Although BOD 26-04 targets only federal agencies, CISA urged all security teams, including those in the private sector, to prioritize patches for this vulnerability to defend their networks against ongoing attacks.

"These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise," it warned. "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

Targeted in autonomous AI attack

While CISA didn't share more details on attackers exploiting CVE-2026-20320 in the wild, threat intelligence firm Malbear Labs said over the weekend that a Chinese-speaking threat actor has exploited the flaw with the help of a jailbroken DeepSeek Flash artificial intelligence model in attacks targeting a European telecommunications provider and thirteen organizations that used its data centers and cloud infrastructure.

The attack focused on the telecom provider's BroadWorks XSP (eXtended Services Platform), and Malbear Labs found that the BroadWorks Provisioning Server (which stores subscriber configuration for all users) was also exposed via an unauthenticated directory listing.

"The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser. A crafted OCI request to port 2208 causes the XML parser to read arbitrary files from the server filesystem and no prior authentication required," Malbear Labs said.

"From the XSP host, the agent recovered the system identity private key, three SSL credential sets, and three additional private keys with certificate matches confirmed. The system identity key is used by the BroadWorks platform to authenticate between its own components; possessing it allows impersonation of the XSP in inter-component communication."

Since November 2021, CISA has added 103 Cisco vulnerabilities to its list of actively exploited flaws, seven of which have also been abused by ransomware gangs.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.