CISA Adds Cisco BroadWorks XXE Flaw to KEV, Patch Now

What changed: CISA added CVE-2026-20320, an XML external entity (XXE) flaw in Cisco BroadWorks, to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, November 10. Federal civilian agencies must secure their systems by November 24. BleepingComputer reported that Cisco patched the bug in August, so this is a patch you should already have.

What to do

1. Find your BroadWorks deployments. BroadWorks is the cloud unified communications platform telecom carriers and managed service providers use to deliver branded cloud PBX and voice services. If you run it, or buy service from someone who does, this applies to you.
2. Confirm the August Cisco fix is installed. Check against Cisco’s advisory for CVE-2026-20320 and your installed release.
3. Treat anything unpatched and reachable as a priority. The flaw needs no authentication and is reachable by sending crafted XML to the Open Client Interface - Provisioning (OCI-P) service. Cisco said the issue exists because external entity resolution was allowed by default.
4. Restrict exposure of the provisioning interface. It should not face the internet. That does not replace the patch.
5. If you were exposed while unpatched, assume file contents were read. The flaw lets an attacker read files, including sensitive configuration. Plan to rotate certificates, private keys and credentials stored on the affected host.

CISA urged private-sector teams to prioritize this fix too, even though its directive, BOD 26-04, binds only federal agencies.

What is known about the attacks

CISA has not published details on who is exploiting the flaw. Threat intelligence firm Malbear Labs said over the weekend that a Chinese-speaking threat actor used it, with a jailbroken DeepSeek Flash AI model, against a European telecom provider and thirteen organizations using its data centers and cloud infrastructure, per BleepingComputer. That is the firm’s account and we have not seen it independently confirmed.

Malbear says the attacker recovered a system identity private key, three sets of SSL credentials and three further private keys from the XSP (eXtended Services Platform) host. It says the system identity key is used to authenticate BroadWorks components to one another, so holding it allows impersonating the XSP. Malbear also found the provisioning server, which stores subscriber configuration, exposed through an unauthenticated directory listing.

The practical read: patching closes the hole, but it does not undo a key that was already copied. If you cannot rule out earlier access, rotating those secrets is the step that matters.

Priority call

Patch internet-reachable BroadWorks first, then internal. The severity is rated high, not critical, and the impact is information disclosure. But the disclosed material here is the kind that unlocks further access, which is why the exploitation reports outweigh the score.

CISA has added 103 Cisco vulnerabilities to KEV since November 2021, seven of which ransomware groups have also abused, according to BleepingComputer. For recent Cisco coverage, see Cisco Patches ASA/FTD VPN Zero-Day, Active Attacks and Cisco Patches Exploited Email Gateway File Write Bug. More in the Cisco hub.