VULNpocalypse
HighVulnerabilityActive

Cisco BroadWorks CVE-2026-20320 and Openwave flaw added to CISA KEV

CISA added exploited Cisco BroadWorks and Openwave flaws to its KEV list; patch now, federal deadline is November 24, 2026.

Published
Fixed in
Cisco BroadWorks fix released August 2026 and Openwave Webtop Media Transcoder fix released October 2026, version numbers not confirmed
Exploitation
Yes, CISA added both flaws to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation, but how they are exploited is not confirmed

Live scores

CVE-2026-20320
EPSS
0.008
low predicted chance of attack
VEDAS
0.512
likely exploited
On CISA KEV
Yes, since 2026-11-10
Detection rule
No public rule yet

Live scores

CVE-2026-111793
EPSS
0.006
low predicted chance of attack
VEDAS
0.513
likely exploited
On CISA KEV
Yes, since 2026-11-10
Detection rule
No public rule yet

What happened

On Tuesday, November 10, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. Two of them are the subject of this advisory: CVE-2026-20320 in Cisco BroadWorks and CVE-2026-111793 in Openwave Messaging Webtop Media Transcoder. CISA lists them as an improper restriction of XML external entity reference (Cisco) and an incorrect resource transfer between spheres (Openwave).

Details as reported by The Hacker News:

  • CVE-2026-20320 (CVSS 7.5): an XML external entity flaw in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks. An unauthenticated, remote attacker could read sensitive configuration information with the privileges of the Cisco BroadWorks user. Fixed in August 2026.
  • CVE-2026-111793 (CVSS 4.3): an authenticated user could process and convert unintended document types by bypassing the Webmail experience. Fixed in October 2026.

The420.in reports the same CVSS scores, patch timing and the November 24, 2026 deadline for Federal Civilian Executive Branch (FCEB) agencies.

How the flaws are being exploited is not confirmed. The Hacker News says there are no details on exploitation in real-world attacks and no attribution to a named threat actor, and that Cisco’s advisory does not mention malicious use. The420.in says the same about attribution. It adds its own reading that attacks surfaced after disclosure, which the other sources do not state.

Am I affected?

You may be affected if you operate Cisco BroadWorks (the OCI XML Parser is the affected component) or Openwave Messaging with the Webtop Media Transcoder, and have not applied the fixes released in August 2026 and October 2026 respectively.

Not confirmed in the sources: the affected and fixed version numbers, the exposure conditions, and indicators of compromise. Check the vendor advisories for those.

The same CISA alert lists four other KEV additions (two Barracuda Networks entries, one Microsoft Office Outlook entry and one Google Chromium entry), per CISA. They are outside the scope of this advisory.

What to do now

  1. Find every Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder deployment in your environment, including internet-facing ones.
  2. Apply the Cisco BroadWorks fix for CVE-2026-20320 (released August 2026) and the Openwave fix for CVE-2026-111793 (released October 2026). Take exact version numbers from the vendor advisories, as the news sources do not give them.
  3. If you are an FCEB agency, meet the November 24, 2026 deadline, per The Hacker News. CISA also encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities, per CISA.
  4. Check the CISA KEV catalog entries for these two CVEs for the current action text and whether forensic triage is required under BOD 26-04. The catalog excerpt available to us was truncated for the Cisco entry, so this is not confirmed. See the KEV catalog.
  5. The420.in reports that guidance issued alongside the federal advisory suggests reviewing external-facing infrastructure and disabling non-essential services. Treat this as general guidance, not specific to these CVEs.

Update, 11 November 2026

  • SecurityWeek says Malbear Labs warned on November 8 that a Chinese-speaking threat actor has been exploiting CVE-2026-20320 in a broad campaign that used an autonomous AI intrusion harness against a European telecommunications provider and its customers. (securityweek.com)
  • SecurityWeek says at least 13 organizations using the targeted telecoms provider’s services may have been targeted, with the campaign focused on asset enumeration, credential theft, and harvesting of subscriber billing and device records. (securityweek.com)
  • SecurityWeek says Cisco’s advisory attributes CVE-2026-20320 to external entity resolution being allowed by default, exploitable by sending a crafted XML message to the Open Client Interface - Provisioning (OCI-P) service. Patches are in version RI.2026.07 of BroadWorks Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform. (securityweek.com)
  • SecurityWeek says Openwave Webtop Media Transcoder version 1.1.22.0 contains the patches for CVE-2026-111793, which exists because administrator-defined file-type restrictions are not enforced. The defect was disclosed on October 7 and a CVE record was published on October 16. (securityweek.com)
  • SecurityWeek says Japan’s JVN flagged CVE-2026-111793 as exploited on November 9, warning that an authenticated attacker could upload a specially crafted file to obtain sensitive information. (securityweek.com)

Sources