The Hacker News reported that CISA had added two vulnerabilities — in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder — to the Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. However, verification of this claim revealed significant inconsistencies: Cisco states that it is not aware of any malicious use of CVE-2026-20320, and it was not possible to confirm, based on publicly available CISA materials, that both vulnerabilities were added to KEV. Nevertheless, the BroadWorks vulnerability itself has been confirmed by the vendor, affects four product roles, allows remote exploitation without authentication, and has no workarounds — which makes prompt patching a priority task for telecom operators and service providers.
Technical details of CVE-2026-20320
According to the official Cisco advisory, the CVE-2026-20320 vulnerability belongs to class CWE-611 (Improper Restriction of XML External Entity Reference) and has been assigned a score of CVSS 7.5 (High). The issue resides in the XML parser of the Open Client Interface (OCI) of the BroadWorks platform: external XML entities are resolved by default, which allows an unauthenticated remote attacker to send a specially crafted XML message and read configuration data or sensitive files from the file system with the privileges of the BroadWorks user.
The following products are affected when vulnerable BroadWorks releases are used, regardless of device configuration:
- BroadWorks Application Delivery Platform
- BroadWorks Application Server
- BroadWorks Profile Server
- BroadWorks Xtended Services Platform
All releases earlier than RI.2026.07 are vulnerable. This release is the first fixed one for all four products. Cisco emphasizes that there are no workarounds to remediate the vulnerability — the only solution is to update the software.
The Openwave vulnerability: unresolved inconsistencies
The second vulnerability mentioned in the original report as CVE-2026-111793 (CVSS 4.3, Medium) is related to Openwave Messaging Webtop Media Transcoder. However, significant discrepancies were found during verification. The associated Openwave advisory uses the identifier CAN-2026-2032674, not CVE-2026-111793, and does not map one identifier to the other. In addition, the original report claims that the vulnerability was fixed in October 2026, whereas the Openwave advisory points to version 1.1.22.0, released on December 6, 2021, as the fixed version. These contradictions in identification and timeline do not allow the information about this vulnerability to be considered confirmed.
Substantively, the vulnerability lies in the fact that Webtop Media Transcoder does not enforce certain file type restrictions defined by the administrator, allowing an authenticated user to process and convert unintended document types by bypassing the Webmail interface. This is significantly different from the BroadWorks vulnerability: here, authentication and a specific bypass are required, which greatly narrows the attack surface.
Contradictions in the exploitation status
The central claim of the original report — that both vulnerabilities were added to the CISA KEV catalog on the basis of active exploitation — could not be independently confirmed. Moreover, it directly contradicts the vendor’s position: the Cisco PSIRT advisory states that the team is not aware of any public reports or malicious use of the CVE-2026-20320 vulnerability. None of the available sources describes specific exploitation methods or names threat groups or campaigns associated with these vulnerabilities.
At the same time, it is worth noting that Cisco products have repeatedly been the target of active exploitation in recent months. We previously wrote about a DoS vulnerability in Cisco ASA and FTD (CVE-2026-76418), as well as about a critical vulnerability in Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) — both have been confirmed as actively exploited. These vulnerabilities are also mentioned in the original report as recent examples.
Impact assessment and prioritization
Cisco BroadWorks is a unified communications platform widely used by telecommunications operators and service providers. An XXE vulnerability that allows reading configuration files without authentication poses a serious risk: a configuration leak can reveal credentials, network topology, integration parameters with adjacent systems, and other information useful for furthering an attack.
From a prioritization perspective, CVE-2026-20320 in BroadWorks warrants primary attention compared to the Openwave vulnerability for several reasons: remote access without authentication, four affected product roles, the absence of workarounds, and a higher CVSS score. The Openwave vulnerability, by contrast, requires authentication and a specific interface bypass, while its identification and the timeline of the fix contain unresolved inconsistencies.
Recommendations
- Cisco BroadWorks: update all instances of Application Delivery Platform, Application Server, Profile Server, and Xtended Services Platform to release RI.2026.07 or later. There are no workarounds — patching is the only protection measure.
- Openwave Webtop Media Transcoder: according to the Openwave advisory, update to the latest supported release of Media Server 2.0. Given the contradictions in the vulnerability’s identification, contact the vendor to clarify the applicability of the specific fix to your version.
- Audit the exposure of BroadWorks OCI/OCI-P interfaces to external networks. Restricting network access to these interfaces reduces the risk of exploitation until the update is applied.
- Check OCI-P logs for anomalous XML requests containing external entities or references to local files.
Regardless of whether active exploitation of CVE-2026-20320 is eventually confirmed, the characteristics of the vulnerability — remote access without authentication, file reading, no workarounds — make updating to RI.2026.07 a top-priority task for all organizations running Cisco BroadWorks. Openwave operators are advised to clarify the exact identifier and fix status with the vendor before relying on information from secondary sources.
