# SZB-26834c9f14: CISA adds Cisco BroadWorks and Openwave flaws to KEV catalog over active exploitation

CISA added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.

- Type: Early warning
- Kind: Pending CVE
- Vendor: Cisco
- Product: BroadWorks
- Status: Confirmed
- Sources: 7 distinct
- First seen: 2026-11-10 21:16 UTC
- Confirmed: 2026-11-11 06:16 UTC

Written by a model from the sources below. Verify against them.

## Summary

CISA added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The item says CVE-2026-20320 (CVSS 7.5) is an XML external entity restriction flaw, and that patches are available.

## What to do

- Apply the vendor patches for Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder now
- Check whether affected BroadWorks or Openwave systems are exposed to untrusted networks
- Review logs for signs of XML external entity exploitation
- Follow the federal remediation deadline in the CISA KEV entry if applicable
- Check whether Cisco BroadWorks and Openwave systems are exposed and apply vendor patches for the listed CVEs.
- Review logs for signs of exploitation and unusual access to configuration data.

## Timeline

- 2026-11-10 21:15 UTC: Made public by Mastodon
- 2026-11-10 21:16 UTC: First seen by cve.now
- 2026-11-11 06:16 UTC: Confirmed as CVE-2026-20320
- 2026-11-11 14:30 UTC: Record last updated

## Evidence (7 sources)

- 2026-11-10 · Social · [Mastodon](https://mastodon.social/@ninjaintelgroup/117594214275006533): “Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.”
- 2026-11-10 · Social · [Mastodon](https://infosec.exchange/@infonewscyber/117594280070030531): “⚠️ FAILLE CRITIQUE CVE-2026-20320 activement exploitée : restriction inadéquate des références à des entités externes XML dans Cisco BroadWorks”
- 2026-11-11 · Press · [The Hacker News](https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html): “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.”
- 2026-11-11 · Social · [Mastodon](https://infosec.exchange/@xploitdigest_kev/117596376593998646): “CISA lists CVE-2026-20320 as exploited (added 10 Nov 2026).” (+2 more: [Mastodon](https://mastodon.social/@threataft/117598282581958776), [Mastodon](https://infosec.exchange/@threataft/117598283024386247))
- 2026-11-11 · Press · [SecurityWeek](https://www.securityweek.com/threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities/): “The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.”
- 2026-11-11 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks/): “The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzzprbgfab2z))
- 2026-11-11 · Social · [Mastodon](https://infosec.exchange/@Secquill/117597362563604413): “CISA has added a Cisco BroadWorks flaw to its list of exploited vulnerabilities.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-26834c9f14&body=https%3A%2F%2Fcve.now%2FSZB-26834c9f14%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-26834c9f14

### Has Cisco confirmed it?

Yes. Confirmed as CVE-2026-20320.

Source: https://mastodon.social/@ninjaintelgroup/117594214275006533, https://infosec.exchange/@infonewscyber/117594280070030531, https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html, https://infosec.exchange/@xploitdigest_kev/117596376593998646, https://www.securityweek.com/threat-actors-exploit-openwave-cisco-broadworks-vulnerabilities/, https://www.bleepingcomputer.com/news/security/cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks/, https://infosec.exchange/@Secquill/117597362563604413

### What should Cisco users do?

Apply the vendor patches for Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder now. Check whether affected BroadWorks or Openwave systems are exposed to untrusted networks. Review logs for signs of XML external entity exploitation. Follow the federal remediation deadline in the CISA KEV entry if applicable. Check whether Cisco BroadWorks and Openwave systems are exposed and apply vendor patches for the listed CVEs. Review logs for signs of exploitation and unusual access to configuration data.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-20320 and CVE-2026-111793.

Source: https://cve.now/CVE-2026-20320, https://cve.now/CVE-2026-111793

## Tracked as

- [CVE-2026-20320](https://cve.now/CVE-2026-20320.md)
- [CVE-2026-111793](https://cve.now/CVE-2026-111793.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-26834c9f14
Site guide for agents: https://cve.now/llms.txt