{"id":"CVE-2026-20320","kind":"vulnerability","aliases":["CVE-2026-20320"],"related":[],"title":"Cisco BroadWorks: unauthenticated XML flaw lets attackers read server files and private keys, exploited against a telecom","description":"Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"XML external entity (XXE) flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks (CVSS 7.5, bug CSCwv48590). External entity resolution is on by default, so an unauthenticated remote attacker who sends a crafted XML message to the OCI-Provisioning (OCI-P) service can read files from the filesystem with the privileges of the BroadWorks user. Cisco published the advisory on 2026-08-19 with a fix in RI.2026.07 and no workaround. At that time Cisco PSIRT knew of no malicious use (the advisory is still v1.0). CISA added the flaw to KEV on 2026-11-10 (due 2026-11-24). Malbear Labs' Operation Snowball report (2026-11-08) describes a jailbroken DeepSeek agent harness exploiting it on a European telecom's BroadWorks XSP (Release 23.0.1.1075, port 2208). Per the report, the agent recovered the XSP system identity private key, three SSL credential sets and three more private keys, then moved laterally into hosted organisations. These findings are the researchers' reading of the attacker's transcripts and have not been confirmed by any victim. No public PoC was found.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-11-10T00:00:00+00:00","products":[{"name":"Cisco BroadWorks","fixed":["RI.2026.07"],"affected":"< RI.2026.07","ecosystem":"vendor"},{"name":"BroadWorks Application Server","fixed":["RI.2026.07"],"affected":"< RI.2026.07","ecosystem":"vendor"},{"name":"BroadWorks Profile Server","fixed":["RI.2026.07"],"affected":"< RI.2026.07","ecosystem":"vendor"},{"name":"BroadWorks Xtended Services Platform","fixed":["RI.2026.07"],"affected":"< RI.2026.07","ecosystem":"vendor"},{"name":"BroadWorks Application Delivery Platform","fixed":["RI.2026.07"],"affected":"< RI.2026.07","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco-broadworks","exploited","internet-facing","self-hosted","service-provider","telephony","unauthenticated","vendor","voip","xxe"],"not_affected_if":["managed-hosting","patched-ri-2026-07","unknown"],"how_to_check":"1) Inventory every BroadWorks Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform (on ADP, the Open Client Server and OCIOverSoap are the affected parts). Cisco says any release earlier than RI.2026.07 is vulnerable regardless of configuration. Check the installed release on each server, for example with bwshowver. Legacy numbered releases (R23/R24/R25) fall under 'earlier than RI.2026.07'. 2) Exposure: find out whether OCI-P can be reached from untrusted networks. Port 2208 was exploited in Operation Snowball. Also check the OCI over SOAP / OCS web endpoints on XSP/ADP. Review AS_CLI/System/NetworkAccessLists/OCI/Provisioning. Cisco does not count access restriction as a workaround, but it reduces who can reach the parser. 3) If an unpatched server was reachable, treat its readable files as disclosed: the system identity private key, SSL/TLS keys and certificates, and stored credentials. Hunt for the Operation Snowball IOCs: api.tablacysexplorer[.]com, 146.70.53[.]182, 113.23.212[.]15, 212.46.38[.]73. Also look for JSP webshells and unexpected systemd units on XSP hosts. Workarounds: none (Cisco).","fix":"Upgrade BroadWorks Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform to RI.2026.07 or later (first fixed release for all four, per Cisco). Cisco lists no patch for older numbered releases and no workaround. After patching an exposed server, rotate the BroadWorks system identity key, the TLS private keys/certificates and any credentials readable by the BroadWorks user.","status":"open","published_at":"2026-08-19T17:18:40+00:00","first_seen_at":"2026-11-10T21:15:38+00:00","triaged_at":"2026-11-10T21:16:35+00:00","updated_at":"2026-11-10T21:20:49+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T21:16:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cisco BroadWorks: XML parser flaw lets outsiders read sensitive configuration","impact":"medium","summary":"Cisco BroadWorks has an XML external entity flaw in its Open Client Interface XML parser. An unauthenticated remote attacker can read sensitive configuration information from an affected system, and CISA lists it as actively exploited.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["cisco-broadworks","voip","telephony"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"sensitive configuration information is read by unauthenticated remote attackers","analyst_note":"Find Cisco's advisory for CVE-2026-20320 to confirm affected and fixed BroadWorks releases and the mitigation steps; sources here list none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Cisco BroadWorks with the Open Client Interface reachable by remote clients are exposed. The sources do not name affected versions or which deployment configurations are reachable. CISA directs stakeholders to evaluate each asset's internet exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4797,"output_tokens":499,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Cisco's advisory for CVE-2026-20320 to confirm affected and fixed BroadWorks releases and the mitigation steps; sources here list none.","search":"'-04':286C,312C,343C '-08':124B,170B '-10':158B '-11':157B,161B,169B '-19':125B '-2026':19A,22A '-20320':20A,23A '-24':162B '2026':123B,156B,160B,168B '2208':189B '23.0.1.1075':187B '26':285C,311C,342C '7.5':75B 'accord':275C 'action':271C 'add':150B 'adher':339C 'advisori':121B,145B 'affect':267C 'agent':175B,194B 'allow':255C 'appli':272C 'applic':309C 'application':27A,37A 'asset':333C 'attack':7A,89B,225B,259C 'base':290C 'bod':284C,310C,341C 'broadwork':2A,42B,73B,116B,184B,242C 'broadworks':25A,26A,29A,32A,36A 'bug':76B 'cisa':149B,269C,282C,299C 'cisco':1A,24A,41B,72B,118B,137B,241C 'cisco-broadwork':40B 'client':66B 'cloud':315C 'complianc':280C 'configur':263C 'confirm':232B 'contain':243C 'could':254C 'craft':93B 'credenti':204B 'cscwv48590':77B 'cve':18A,21A 'cvss':74B 'deepseek':174B 'default':84B 'delivery':38A 'describ':171B 'discontinu':318C 'due':159B 'ensur':279C,338C 'entiti':60B,79B,250C 'european':181B 'evalu':331C 'exploit':14A,43B,177B 'exposur':336C 'extern':59B,78B,249C 'face':46B 'file':10A,107B 'filesystem':110B 'find':218B 'fix':128B 'flaw':5A,62B,152B 'follow':308C 'forens':301C 'found':240B 'guidanc':297C,313C 'guidelin':345C 'har':176B 'host':49B,215B 'ident':199B 'improp':245C 'inform':264C 'instruct':278C 'interfac':67B 'internet':45B,335C 'internet-fac':44B 'jailbroken':173B 'kev':154B 'key':13A,201B,210B 'knew':139B 'lab':164B 'later':213B 'let':6A 'malbear':163B 'malici':142B 'messag':95B 'mitig':273C,324C 'move':212B 'note':296C,307C 'oci':68B,99B,102B 'oci-p':101B 'oci-provis':98B 'open':65B 'oper':165B 'organis':216B 'p':103B 'parser':70B 'patch':344C 'per':190B 'platform':35A,39A 'poc':238B 'port':188B 'priorit':287C 'privat':12A,200B,209B 'privileg':113B 'product':322C 'profile':30A 'provid':52B 'provis':100B 'psirt':138B 'public':237B 'publish':119B 'read':8A,106B,222B,261C 'recov':195B 'refer':251C 'releas':186B 'remot':88B,258C 'report':167B,192B 'requir':270C,303C 'research':221B 'resolut':80B 'respons':329C 'restrict':246C 'ri.2026.07':130B 'risk':292C 'secur':288C 'see':293C,304C 'self':48B 'self-host':47B 'send':91B 'sensit':262C 'server':9A,28A,31A 'servic':51B,104B,316C 'service-provid':50B 'services':34A 'set':205B 'snowbal':166B 'ssl':203B 'stakehold':327C 'still':147B 'system':198B,268C 'telecom':17A,182B 'telephoni':53B 'three':202B,207B 'time':136B 'transcript':227B 'triag':302C 'unauthent':3A,54B,87B,257C 'unavail':326C 'updat':289C 'url':294C,305C 'use':143B,319C 'user':117B 'v1.0':148B 'vendor':55B,277C 'victim':235B 'voip':56B 'vulner':252C 'workaround':133B 'xml':4A,58B,69B,94B,248C 'xsp':185B,197B 'xtended':33A 'xxe':57B,61B","nicknames":[],"mitigations":[],"who_affected":"Telecom operators and hosted voice / UCaaS providers that run their own Cisco BroadWorks platform are affected when any Application Server, Profile Server, Xtended Services Platform or Application Delivery Platform runs a release earlier than RI.2026.07. Cisco says this holds regardless of configuration. The attack path is a crafted XML message to the OCI-Provisioning service (port 2208 in the observed attack), so the most urgent servers are those where OCI-P or the OCI-over-SOAP/OCS endpoints can be reached from the internet or from tenant networks. Businesses that only buy hosted calling from a provider cannot patch anything themselves and can skip this, apart from asking their provider whether it has moved to RI.2026.07.","tier":"A","verified":{"fix":{"at":"2026-11-10T21:20:49Z","by":"analyst","doc":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt","run_id":2778},"products":{"at":"2026-11-10T21:20:49Z","by":"analyst","doc":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt","run_id":2778},"who_affected":{"at":"2026-11-10T21:20:49Z","by":"analyst","doc":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt","run_id":2778}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["applicationdeliveryplatform","applicationserver","broadworks","broadworksapplicationdeliveryplatform","broadworksapplicationserver","broadworksprofileserver","broadworksxtendedservicesplatform","ciscobroadworks","profileserver","xtendedservicesplatform"],"ptokens":["application","broadworks","cisco","delivery","platform","profile","server","services","xtended"],"labels":["ciscobroadworks","exploited","high","internetfacing","selfhosted","serviceprovider","telephony","unauthenticated","vendor","voip","xxe"],"campaign_type":null,"search_a":"'-2026':19A,22A '-20320':20A,23A 'application':27A,37A 'attack':7A 'broadwork':2A 'broadworks':25A,26A,29A,32A,36A 'cisco':1A,24A 'cve':18A,21A 'delivery':38A 'exploit':14A 'file':10A 'flaw':5A 'key':13A 'let':6A 'platform':35A,39A 'privat':12A 'profile':30A 'read':8A 'server':9A,28A,31A 'services':34A 'telecom':17A 'unauthent':3A 'xml':4A 'xtended':33A","search_b":"'-08':124B,170B '-10':158B '-11':157B,161B,169B '-19':125B '-24':162B '2026':123B,156B,160B,168B '2208':189B '23.0.1.1075':187B '7.5':75B 'add':150B 'advisori':121B,145B 'agent':175B,194B 'attack':89B,225B 'broadwork':42B,73B,116B,184B 'bug':76B 'cisa':149B 'cisco':41B,72B,118B,137B 'cisco-broadwork':40B 'client':66B 'confirm':232B 'craft':93B 'credenti':204B 'cscwv48590':77B 'cvss':74B 'deepseek':174B 'default':84B 'describ':171B 'due':159B 'entiti':60B,79B 'european':181B 'exploit':43B,177B 'extern':59B,78B 'face':46B 'file':107B 'filesystem':110B 'find':218B 'fix':128B 'flaw':62B,152B 'found':240B 'har':176B 'host':49B,215B 'ident':199B 'interfac':67B 'internet':45B 'internet-fac':44B 'jailbroken':173B 'kev':154B 'key':201B,210B 'knew':139B 'lab':164B 'later':213B 'malbear':163B 'malici':142B 'messag':95B 'move':212B 'oci':68B,99B,102B 'oci-p':101B 'oci-provis':98B 'open':65B 'oper':165B 'organis':216B 'p':103B 'parser':70B 'per':190B 'poc':238B 'port':188B 'privat':200B,209B 'privileg':113B 'provid':52B 'provis':100B 'psirt':138B 'public':237B 'publish':119B 'read':106B,222B 'recov':195B 'releas':186B 'remot':88B 'report':167B,192B 'research':221B 'resolut':80B 'ri.2026.07':130B 'self':48B 'self-host':47B 'send':91B 'servic':51B,104B 'service-provid':50B 'set':205B 'snowbal':166B 'ssl':203B 'still':147B 'system':198B 'telecom':182B 'telephoni':53B 'three':202B,207B 'time':136B 'transcript':227B 'unauthent':54B,87B 'use':143B 'user':117B 'v1.0':148B 'vendor':55B 'victim':235B 'voip':56B 'workaround':133B 'xml':58B,69B,94B 'xsp':185B,197B 'xxe':57B,61B","search_c":"'-04':286C,312C,343C '26':285C,311C,342C 'accord':275C 'action':271C 'adher':339C 'affect':267C 'allow':255C 'appli':272C 'applic':309C 'asset':333C 'attack':259C 'base':290C 'bod':284C,310C,341C 'broadwork':242C 'cisa':269C,282C,299C 'cisco':241C 'cloud':315C 'complianc':280C 'configur':263C 'contain':243C 'could':254C 'discontinu':318C 'ensur':279C,338C 'entiti':250C 'evalu':331C 'exposur':336C 'extern':249C 'follow':308C 'forens':301C 'guidanc':297C,313C 'guidelin':345C 'improp':245C 'inform':264C 'instruct':278C 'internet':335C 'mitig':273C,324C 'note':296C,307C 'patch':344C 'priorit':287C 'product':322C 'read':261C 'refer':251C 'remot':258C 'requir':270C,303C 'respons':329C 'restrict':246C 'risk':292C 'secur':288C 'see':293C,304C 'sensit':262C 'servic':316C 'stakehold':327C 'system':268C 'triag':302C 'unauthent':257C 'unavail':326C 'updat':289C 'url':294C,305C 'use':319C 'vendor':277C 'vulner':252C 'xml':248C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-19T17:18:40+00:00","kev":{"dateAdded":"2026-11-10","dueDate":"2026-11-24","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20320","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320","severity":null,"published_at":"2026-11-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T21:15:38+00:00","fetched_at":"2026-11-10T21:15:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-20320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20320","severity":null,"published_at":"2026-08-19T17:18:40+00:00","modified_at":"2026-11-10T20:19:11+00:00","first_seen_at":"2026-11-10T21:15:57+00:00","fetched_at":"2026-11-10T21:15:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-20320:2778","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt","severity":null,"published_at":"2026-11-10T21:20:49+00:00","modified_at":"2026-11-10T21:20:49+00:00","first_seen_at":"2026-11-10T21:20:49+00:00","fetched_at":"2026-11-10T21:20:49+00:00","note":"Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt read: AS/PS/XSP/ADP earlier than RI.2026.07 are affected, RI.2026.07 is the fix, no workarounds, and PSIRT reported no exploitation as of v1.0 (2026-08-19). Exploitation comes from CISA KEV (2026-11-10) and Malbear Labs' Operation Snowball report (XSP R23 on port 2208, keys stolen). I created campaign CMP-202611-xbilrl. bwshowver and the port-2208 exposure check are not from Cisco and are not verified. X has only aggregator posts, none saved. No PoC found.","cites":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt","https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign","https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog","https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/","https://www.cisco.com/c/en/us/support/docs/unified-communications/broadworks-application-server/220164-configure-broadworks-ocisendertool.html"]}],"documents":[{"id":118816,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt","title":"Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118817,"url":"https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign","title":"Malbear Labs: Operation Snowball, autonomous AI intrusion exploiting BroadWorks XSP CVE-2026-20320","kind":"blog","source":"analyst","publisher":null,"text":"Malbear Labs, \"Operation Snowball: Inside an Autonomous AI Intrusion Campaign\", 2026-11-08. BroadWorks passages (verbatim):\n\n\"The primary target on the telecommunications provider's infrastructure was the BroadWorks XSP (eXtended Services Platform), Release 23.0.1.1075, running on port 2208.\"\n\"The agent exploited CVE-2026-20320, an unauthenticated XXE in the BroadWorks OCI XML parser. A crafted OCI request to port 2208 causes the XML parser to read arbitrary files from the server filesystem ... and no prior authentication required.\"\n\"From the XSP host, the agent recovered the system identity private key, three SSL credential sets, and three additional private keys with certificate matches confirmed. The system identity key is used by the BroadWorks platform to authenticate between its own components; possessing it allows impersonation of the XSP in inter-component communication.\"\n\"The BroadWorks Provisioning Server was separately exposed with an unauthenticated directory listing. The Provisioning Server holds subscriber configuration for every user on the platform.\"\n\nReport context: an open directory exposed ~70 session transcripts of a jailbroken DeepSeek Flash agent harness (v0.2.0-rc.2) run by a Chinese-speaking operator for 2+ weeks against a European telecom provider and 13 hosted organisations. Findings are the researchers' reading of the attacker's transcripts; victims not named, not independently confirmed.\nIOCs (from report table): api.tablacysexplorer[.]com (Sliver C2, Cloudflare-fronted); 146.70.53[.]182:2299 (SSH to Sliver server); 113.23.212[.]15:8000 (tool staging); 212.46.38[.]73:56777 (operator secondary machine). No BroadWorks-specific request IOCs published.\n","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118818,"url":"https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog","title":"CISA adds six KEVs incl. CVE-2026-20320 (2026-11-10, due 2026-11-24)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":118819,"url":"https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/","title":"Infosecurity Magazine: Jailbroken AI agent ran two-week attack on European telecom","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":118820,"url":"https://www.cisco.com/c/en/us/support/docs/unified-communications/broadworks-application-server/220164-configure-broadworks-ocisendertool.html","title":"Cisco: Configure BroadWorks OCISenderTool (OCI-P Network Access List)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"kev","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320","date_added":"2026-11-10","due_date":"2026-11-24","ransomware":"Unknown"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}