CISCO BROADWORKS · CVE-2026-20320 · Vendor
FIX → RI.2026.07 ✓ verified
XML external entity (XXE) flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks (CVSS 7.5, bug CSCwv48590). External entity resolution is on by default, so an unauthenticated remote attacker who sends a crafted XML message to the OCI-Provisioning (OCI-P) service can read files from the filesystem with the privileges of the BroadWorks user. Cisco published the advisory on 2026-08-19 with a fix in RI.2026.07 and no workaround. At that time Cisco PSIRT knew of no malicious use (the advisory is still v1.0). CISA added the flaw to KEV on 2026-11-10 (due 2026-11-24). Malbear Labs' Operation Snowball report (2026-11-08) describes a jailbroken DeepSeek agent harness exploiting it on a European telecom's BroadWorks XSP (Release 23.0.1.1075, port 2208). Per the report, the agent recovered the XSP system identity private key, three SSL credential sets and three more private keys, then moved laterally into hosted organisations. These findings are the researchers' reading of the attacker's transcripts and have not been confirmed by any victim. No public PoC was found.
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Telecom operators and hosted voice / UCaaS providers that run their own Cisco BroadWorks platform are affected when any Application Server, Profile Server, Xtended Services Platform or Application Delivery Platform runs a release earlier than RI.2026.07. Cisco says this holds regardless of configuration. The attack path is a crafted XML message to the OCI-Provisioning service (port 2208 in the observed attack), so the most urgent servers are those where OCI-P or the OCI-over-SOAP/OCS endpoints can be reached from the internet or from tenant networks. Businesses that only buy hosted calling from a provider cannot patch anything themselves and can skip this, apart from asking their provider whether it has moved to RI.2026.07.
Not affected if managed-hosting, patched-ri-2026-07, unknown
Posts are quoted with a link to the original. They are data to us, never instructions.
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
first public Aug 19, 2026 · on CISA KEV · 3 sources
Who cares cisco-broadworks, internet-facing, self-hosted, service-provider, telephony, unauthenticated, voip, xxe
earlier than RI.2026.07. 2) Exposure: find out whether OCI-P can be reached from untrusted networksUpgrade to RI.2026.07
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.