Cisco BroadWorks: CVE-2026-20320 under active exploitation

What CVE-2026-20320 is and who it affectsCisco BroadWorks, the platform many operators and service providers use to deliver hosted voice, messaging an...

What CVE-2026-20320 is and who it affects

Cisco BroadWorks, the platform many operators and service providers use to deliver hosted voice, messaging and collaboration, carries a high-severity flaw tracked as CVE-2026-20320. The official name is "Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability", a class of bug catalogued as CWE-611.

According to the NVD entry published on 19 August 2026, the problem sits in the Open Client Interface (OCI) XML Parser. XML entries are parsed improperly because external entity resolution is allowed by default. An unauthenticated, remote attacker can send a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service and, if it succeeds, read sensitive files from the filesystem with the privileges of the Cisco BroadWorks user. In practice that means configuration data and other sensitive material could be exposed without any credentials.

The NVD lists the following affected versions, all "up to, but not including" the stated release:

BroadWorks Application Delivery Platform: up to ri.2026.07 (excluding)
BroadWorks Application Server: up to 2026.0 (excluding)
BroadWorks Profile Server: up to 2026.07 (excluding)
BroadWorks Xtended Services Platform: up to 2026.07 (excluding)

Severity is CVSS 3.1 score 7.5 (HIGH), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. In plain terms: reachable over the network, no privileges or user interaction required, and a high impact on confidentiality.

This is not only a concern for large carriers. Any Spanish SME, ecommerce business or small IT team that runs BroadWorks components — directly or through a managed telephony provider — should confirm which release is in production.

Why it is urgent: already exploited in real attacks

The decisive detail is that this is not a theoretical bug. CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, which means there is confirmed exploitation in the wild. The agency gave US federal agencies until 24 November 2026 to apply mitigations in line with vendor instructions, following its BOD 26-04 guidance on prioritising security updates by risk and its forensics triage requirements.

CISA also asks asset owners to evaluate each system's internet exposure. That point matters for everyone, not just federal agencies: an OCI-P service reachable from the public internet is exactly the kind of surface this flaw targets. The KEV entry does not record known use in ransomware campaigns, so the immediate risk is data exposure and reconnaissance rather than encryption, but that does not make it less pressing.

What to do today

Inventory first. Check whether any BroadWorks component (Application Delivery Platform, Application Server, Profile Server, Xtended Services Platform) is in use, and pin down the exact version. Compare it against the ranges above.
Apply the vendor advisory. Cisco's security advisory for this issue (cisco-sa-bworks-xxe-uwUd7CEt) is the authoritative source for the fix and any interim mitigation. Apply exactly what the advisory states; do not assume a specific corrected release beyond what Cisco publishes.
Look for signs of intrusion. Because exploitation is a crafted XML message to OCI-P, review logs and traffic touching that interface for unexpected requests, and check whether configuration files may have been read. If you find evidence, treat it as an incident and preserve logs before changing anything.
Shrink the attack surface. Restrict who can reach OCI-P, close public exposure where it is not strictly needed, and review firewall rules around management and provisioning interfaces.
Keep the rest patched. A flaw like this rarely arrives alone. Keep CMS platforms such as WordPress, PrestaShop and Joomla, plus servers and dependencies, on a regular patch cycle.

How a cybersecurity team such as ALMC's can help

For SMEs, online shops and lean IT departments, the hard part is rarely reading the advisory — it is knowing what is exposed, in which version, and what to do first. At ALMC we work on exactly that: security audits and pentesting to find vulnerabilities before someone exploits them, server hardening to reduce what is reachable from the internet, monitoring and incident response when something looks wrong, and repair of hacked websites.

We also handle ongoing maintenance and updates for WordPress, PrestaShop and Joomla, which is where many smaller organisations accumulate unpatched risk. If your team is small and the BroadWorks question lands on your desk alongside everything else, an external pair of hands to map exposure, verify versions and prioritise the fixes — in line with GDPR obligations around personal data — is often the quickest route to a calmer night.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.