---
id: "CVE-2026-20320"
page: "https://infrastack.ai/live/CVE-2026-20320"
kind: "vulnerability"
aliases: ["CVE-2026-20320"]
title: "Cisco BroadWorks: unauthenticated XML flaw lets attackers read server files and private keys, exploited against a telecom"
severity: "high"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Cisco BroadWorks", "fixed": ["RI.2026.07"], "affected": "< RI.2026.07", "ecosystem": "vendor"}, {"name": "BroadWorks Application Server", "fixed": ["RI.2026.07"], "affected": "< RI.2026.07", "ecosystem": "vendor"}, {"name": "BroadWorks Profile Server", "fixed": ["RI.2026.07"], "affected": "< RI.2026.07", "ecosystem": "vendor"}, {"name": "BroadWorks Xtended Services Platform", "fixed": ["RI.2026.07"], "affected": "< RI.2026.07", "ecosystem": "vendor"}, {"name": "BroadWorks Application Delivery Platform", "fixed": ["RI.2026.07"], "affected": "< RI.2026.07", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco-broadworks", "exploited", "internet-facing", "self-hosted", "service-provider", "telephony", "unauthenticated", "vendor", "voip", "xxe"]
not_affected_if: ["managed-hosting", "patched-ri-2026-07", "unknown"]
published_at: "2026-08-19T17:18:40+00:00"
first_seen_at: "2026-11-10T21:15:38+00:00"
updated_at: "2026-11-10T21:20:49+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320", "first_seen_at": "2026-11-10T21:15:38+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20320", "first_seen_at": "2026-11-10T21:15:57+00:00"}, {"source": "analyst", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt", "first_seen_at": "2026-11-10T21:20:49+00:00", "cites": ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt", "https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign", "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog", "https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/", "https://www.cisco.com/c/en/us/support/docs/unified-communications/broadworks-application-server/220164-configure-broadworks-ocisendertool.html"]}]
exploit_sources: [{"type": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320", "date_added": "2026-11-10", "due_date": "2026-11-24", "ransomware": "Unknown"}]
---

# Cisco BroadWorks: unauthenticated XML flaw lets attackers read server files and private keys, exploited against a telecom

Link for people: https://infrastack.ai/live/CVE-2026-20320 (this .md is for agents)

XML external entity (XXE) flaw in the Open Client Interface (OCI) XML parser of Cisco BroadWorks (CVSS 7.5, bug CSCwv48590). External entity resolution is on by default, so an unauthenticated remote attacker who sends a crafted XML message to the OCI-Provisioning (OCI-P) service can read files from the filesystem with the privileges of the BroadWorks user. Cisco published the advisory on 2026-08-19 with a fix in RI.2026.07 and no workaround. At that time Cisco PSIRT knew of no malicious use (the advisory is still v1.0). CISA added the flaw to KEV on 2026-11-10 (due 2026-11-24). Malbear Labs' Operation Snowball report (2026-11-08) describes a jailbroken DeepSeek agent harness exploiting it on a European telecom's BroadWorks XSP (Release 23.0.1.1075, port 2208). Per the report, the agent recovered the XSP system identity private key, three SSL credential sets and three more private keys, then moved laterally into hosted organisations. These findings are the researchers' reading of the attacker's transcripts and have not been confirmed by any victim. No public PoC was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco BroadWorks affected < RI.2026.07 fixed RI.2026.07
- vendor:BroadWorks Application Server affected < RI.2026.07 fixed RI.2026.07
- vendor:BroadWorks Profile Server affected < RI.2026.07 fixed RI.2026.07
- vendor:BroadWorks Xtended Services Platform affected < RI.2026.07 fixed RI.2026.07
- vendor:BroadWorks Application Delivery Platform affected < RI.2026.07 fixed RI.2026.07

## How to check

1) Inventory every BroadWorks Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform (on ADP, the Open Client Server and OCIOverSoap are the affected parts). Cisco says any release earlier than RI.2026.07 is vulnerable regardless of configuration. Check the installed release on each server, for example with bwshowver. Legacy numbered releases (R23/R24/R25) fall under 'earlier than RI.2026.07'. 2) Exposure: find out whether OCI-P can be reached from untrusted networks. Port 2208 was exploited in Operation Snowball. Also check the OCI over SOAP / OCS web endpoints on XSP/ADP. Review AS_CLI/System/NetworkAccessLists/OCI/Provisioning. Cisco does not count access restriction as a workaround, but it reduces who can reach the parser. 3) If an unpatched server was reachable, treat its readable files as disclosed: the system identity private key, SSL/TLS keys and certificates, and stored credentials. Hunt for the Operation Snowball IOCs: api.tablacysexplorer[.]com, 146.70.53[.]182, 113.23.212[.]15, 212.46.38[.]73. Also look for JSP webshells and unexpected systemd units on XSP hosts. Workarounds: none (Cisco).

## Fix

Upgrade BroadWorks Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform to RI.2026.07 or later (first fixed release for all four, per Cisco). Cisco lists no patch for older numbered releases and no workaround. After patching an exposed server, rotate the BroadWorks system identity key, the TLS private keys/certificates and any credentials readable by the BroadWorks user.

## Timeline

- 2026-11-10T21:15:38+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20320
- 2026-11-10T21:15:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20320
- 2026-11-10T21:20:49+00:00 analyst https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt — Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt read: AS/PS/XSP/ADP earlier than RI.2026.07 are affected, RI.2026.07 is the fix, no workarounds, and PSIRT reported no exploitation as of v1.0 (2026-08-19). Exploitation comes from CISA KEV (2026-11-10) and Malbear Labs' Operation Snowball report (XSP R23 on port 2208, keys stolen). I created campaign CMP-202611-xbilrl. bwshowver and the port-2208 exposure check are not from Cisco and are not verified. X has only aggregator posts, none saved. No PoC found.

## Documents

- [advisory] Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt
- [describes] Malbear Labs: Operation Snowball, autonomous AI intrusion exploiting BroadWorks XSP CVE-2026-20320 https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign
- [mentions] CISA adds six KEVs incl. CVE-2026-20320 (2026-11-10, due 2026-11-24) https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
- [mentions] Infosecurity Magazine: Jailbroken AI agent ran two-week attack on European telecom https://www.infosecurity-magazine.com/news/operation-snowball-ai-telecom/
- [mentions] Cisco: Configure BroadWorks OCISenderTool (OCI-P Network Access List) https://www.cisco.com/c/en/us/support/docs/unified-communications/broadworks-application-server/220164-configure-broadworks-ocisendertool.html

## From the sources

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_