← Back to Vulnerability Reports CVE Intelligence

CVE-2026-20320

Cisco BroadWorks•HIGH · CVSS 7.5• In the wild In CISA KEV

What is CVE-2026-20320?

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.

CVSS7.5 NVD 3.1
SeverityHIGH
Exploitation In the wild In CISA KEV
EPSS<1% · P33
Triage statusActive Exploit
ActionPatch immediately
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWECWE-611
NVD published2026-08-19
NVD last modified2026-11-11

Timeline

  • 2026-08-19Published to the U.S. National Vulnerability Database (NVD)
  • 2026-11-10Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
  • 2026-11-11NVD record last updated
  • 2026-11-24CISA federal remediation deadline (BOD 22-01)

CISA Known Exploited Vulnerability

Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Added to KEV2026-11-10
Federal patch deadline2026-11-24
Known ransomware useUnknown

Affected product

Cisco BroadWorks

NVD also lists CPE entries for: Cisco Broadworks Application Delivery Platform, Cisco Broadworks Application Server, Cisco Broadworks Profile Server, Cisco Broadworks Xtended Services Platform

Remediation Steps

  1. Check CISA Known Exploited Vulnerabilities catalog for affected product versions
  2. Apply vendor security patch when available
  3. Monitor for exploitation attempts in network traffic and logs

References

Referenced in our briefings & reports

Related vulnerabilities

  • CVE-2026-76418 – Cisco Secure Firewall ASA Software And Cisco Secure FTD Software (same vendor)
  • CVE-2026-76519 – Cisco Secure Email Gateway (same vendor)
  • CVE-2026-76504 – Cisco Catalyst SD-WAN Manager (same vendor)
  • CVE-2026-76460 – Cisco Identity Services Engine (same vendor)
  • CVE-2026-76461 – Cisco Secure Email Gateway (same vendor)
  • CVE-2026-20349 – Cisco Secure Firewall Adaptive Security Appliance (ASA) And Secure Firewall Threat Defense (FTD) (same vendor)

Cisco: 102 known exploited vulnerabilities (CISA KEV) →

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.