CISA added a Cisco BroadWorks vulnerability, CVE-2026-20320, to its Known Exploited Vulnerabilities catalog on Tuesday, November 10, according to BleepingComputer and The Hacker News. BroadWorks is the carrier-grade cloud voice and unified-communications platform that telecom providers and managed service providers use to run hosted phone services for business customers. The flaw is an XML external entity (XXE) weakness in the platform’s Open Client Interface (OCI) XML parser: Cisco’s advisory says an unauthenticated remote attacker who sends a crafted XML message to the OCI-P provisioning service can read sensitive files from the server with the privileges of the BroadWorks user. Cisco rates it 7.5 (High), says there are no workarounds, and published fixes on August 19.
CISA did not say who was exploiting it or how. The detail comes from Malbear Labs, which published a report on November 8 after finding an exposed open directory holding the working files of what it describes as an autonomous AI intrusion harness. According to Malbear, a Chinese-speaking operator used a jailbroken DeepSeek model to run about two weeks of largely unsupervised attacks against a European telecommunications provider and thirteen organizations hosted on its infrastructure. Its primary target was the provider’s BroadWorks Xtended Services Platform (release 23.0.1.1075, port 2208). Malbear says the agent used CVE-2026-20320 to read files from that server and recovered the platform’s system identity private key, three sets of SSL credentials and three further private keys; it also says the BroadWorks Provisioning Server, which holds subscriber configuration for every user on the platform, was separately exposed through an unauthenticated directory listing. Across the campaign Malbear reports hundreds of assets enumerated, dozens of credential sets extracted and thousands of rows of subscriber billing and device records taken from the provider’s billing platform. Cisco’s August advisory said its security team knew of no malicious use at that time; the exploitation reports came afterwards.
The same CISA update added a second flaw, CVE-2026-111793, in the Webtop Media Transcoder from Openwave Messaging (Ireland) Ltd. The Hacker News says it was listed after Japan’s JVN portal reported that the developer had observed attacks. Openwave’s advisory rates it 4.3 (Medium): the transcoder does not enforce administrator-set file-type restrictions, so an authenticated user who bypasses the webmail interface can convert unintended document types. JVN says an authenticated attacker who uploads a specially crafted file could obtain sensitive information.
How to check if you’re affected
Affected products are the Cisco BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform running any release earlier than RI.2026.07, which is the first fixed release for all four, per Cisco’s advisory. Cisco says this applies regardless of device configuration. Cisco’s advisory is the place to match your exact release; it also lists the Cisco bug ID CSCwv48590.
- Operators: upgrade to RI.2026.07 or later. Cisco states there are no workarounds. BleepingComputer reports CISA ordered federal civilian agencies to patch by November 24 and urged private-sector teams to prioritize it.
- If a BroadWorks system was exposed to the internet before patching, our suggestion (not a step from Cisco or CISA) is to treat the files the flaw can read, including the system identity key and SSL credentials Malbear says were taken, as potentially exposed. Malbear’s report lists indicators from this campaign: a Sliver command-and-control domain,
api.tablacysexplorer[.]com, and the addresses146.70.53[.]182,113.23.212[.]15and212.46.38[.]73. - Openwave Webtop Media Transcoder: affected versions are those before 1.1.22.0, per Openwave’s advisory and JVN. The advisory tells customers to upgrade to the latest supported Media Server 2.0 release.
Sources
- Cisco Security Advisory: BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt)
- Malbear Labs: Operation Snowball: Inside an Autonomous AI Intrusion Campaign
- Openwave Messaging public security advisory CAN-2026-2032674
- JVNVU#93403064: Webtop Media Transcoder incorrect resource transfer between spheres
- BleepingComputer: CISA flags Cisco BroadWorks flaw as actively exploited in attacks
- The Hacker News: Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
- CISA’s KEV catalog entry for CVE-2026-20320 (linked from BleepingComputer; the page returned “Access Denied” to our checks and was not read directly)