CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on 10 November 2026 as 'Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability', saying it could allow an unauthenticated, remote attacker to read sensitive configuration information; the US federal due date is 24 November 2026 and known ransomware campaign use is Unknown. (source: CISA KEV)

Cisco's advisory cisco-sa-bworks-xxe-uwUd7CEt (first published 19 August 2026, version 1.0) says the flaw is in the Open Client Interface (OCI) XML parser: external entity resolution is allowed by default, so an attacker can send a crafted XML message to the OCI-Provisioning (OCI-P) service and view sensitive files from the filesystem with the privileges of the BroadWorks user. Affected regardless of configuration: BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform releases earlier than RI.2026.07; first fixed release RI.2026.07.

Cisco says there are no workarounds. Cisco scores it CVSS 3.1 base 7.5 (CWE-611, bug CSCwv48590) and credits Sandesh M Gawai.

Cisco's advisory, unchanged since 19 August, still says the Cisco PSIRT is not aware of malicious use; the exploitation listing is CISA's. (source: Cisco Security Advisory)

UPDATE (11 Nov 2026, Perth): According to BleepingComputer, threat intelligence firm Malbear Labs said that a Chinese-speaking threat actor exploited CVE-2026-20320, using a jailbroken DeepSeek Flash AI model, in attacks on a European telecommunications provider's BroadWorks Xtended Services Platform (XSP) and on thirteen organisations that used its data centres and cloud infrastructure.

Malbear Labs says a crafted OCI request to port 2208 read files from the server, and that the attacker recovered the XSP system identity private key, three SSL credential sets and three more private keys; it also found the BroadWorks Provisioning Server exposed through an unauthenticated directory listing. CISA has not given details of the exploitation it listed. (source: BleepingComputer)