Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

CISA adds Cisco BroadWorks and Openwave flaws to KEV catalog over active exploitation

CISA added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.

SZB-26834c9f14Pending CVEConfirmed

Written by a model from the sources below. Verify against them.

Sources7Confirmed
Kind
Pending CVE
Vendor
Cisco
Product
BroadWorks
Status
Confirmed
First seen
Confirmed

Summary

CISA added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The item says CVE-2026-20320 (CVSS 7.5) is an XML external entity restriction flaw, and that patches are available.

What to do

  • Apply the vendor patches for Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder now

  • Check whether affected BroadWorks or Openwave systems are exposed to untrusted networks

  • Review logs for signs of XML external entity exploitation

  • Follow the federal remediation deadline in the CISA KEV entry if applicable

  • Check whether Cisco BroadWorks and Openwave systems are exposed and apply vendor patches for the listed CVEs.

  • Review logs for signs of exploitation and unusual access to configuration data.

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now1 day
  3. Confirmed as CVE-2026-20320
  4. Record last updated

Evidence 7

  1. Social
    Mastodon
    “Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.”
  2. Social
    Mastodon
    “⚠️ FAILLE CRITIQUE CVE-2026-20320 activement exploitée : restriction inadéquate des références à des entités externes XML dans Cisco BroadWorks”
  3. Press
    The Hacker News
    “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.”
  4. Social
    Mastodon
    “CISA lists CVE-2026-20320 as exploited (added 10 Nov 2026).”
    +2 more: Mastodon, Mastodon
  5. Press
    SecurityWeek
    “The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.”
Show all 7 sourcesShow fewer sources
  1. Press
    BleepingComputer
    “The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks.”
    +1 more: BleepingComputer on Bluesky
  2. Social
    Mastodon
    “CISA has added a Cisco BroadWorks flaw to its list of exploited vulnerabilities.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-26834c9f14

Has Cisco confirmed it?

Yes. Confirmed as CVE-2026-20320.Source: Mastodon, Mastodon, The Hacker News, Mastodon, SecurityWeek, BleepingComputer, Mastodon

What should Cisco users do?

Apply the vendor patches for Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder now. Check whether affected BroadWorks or Openwave systems are exposed to untrusted networks. Review logs for signs of XML external entity exploitation. Follow the federal remediation deadline in the CISA KEV entry if applicable. Check whether Cisco BroadWorks and Openwave systems are exposed and apply vendor patches for the listed CVEs. Review logs for signs of exploitation and unusual access to configuration data.

Does it have a CVE?

Yes. It is tracked as CVE-2026-20320 and CVE-2026-111793.Source: CVE-2026-20320, CVE-2026-111793

Sources

Tracked as