CVE-2026-20320: Cisco BroadWorks XXE now exploited

Call: Patch now. CISA added CVE-2026-20320 to KEV on November 10, due November 24, which means it’s being exploited. Cisco fixed it back on August 19. Cisco’s advisory still says it “is not aware of any public announcements or malicious use.” The advisory hasn’t been updated since August, and CISA’s listing is the newer fact.

What breaks: The Open Client Interface (OCI) XML parser resolves external entities by default. An unauthenticated attacker sends a crafted XML message to the OCI-P provisioning service and reads files “with the privileges of the Cisco BroadWorks user.” Cisco says that includes “sensitive configuration information.” CVSS 7.5. On a voice platform, configuration files are rarely boring.

Who’s hit: BroadWorks Application Delivery Platform (OCS and OCIOverSoap), Application Server, Profile Server and Xtended Services Platform, any release earlier than RI.2026.07, regardless of configuration. In practice, service providers and large hosted-voice shops.

Fix: RI.2026.07 or later on each affected component. Cisco lists no workarounds.

Workaround: None from Cisco. Limiting who can reach OCI-P helps. If you’re still below RI.2026.07 three months after the fix, look at what those config files contain and assume someone else may have too.

Sources: Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt (opens in a new tab), CISA KEV (opens in a new tab).

CVE-2026-20320: Cisco BroadWorks XXE now exploited

Sources

More from November 2026 patch cycle