CVE-2026-20320
An unauthenticated attacker can read sensitive system files via crafted XML messages.
Cisco BroadWorks has a flaw in how its XML parser handles external entities. An unauthenticated attacker can send a specially crafted XML message to the OCI-P service to read sensitive configuration files from the server. CISA has confirmed that attackers are actively exploiting this vulnerability, and while a fix is not yet available, the vendor advises following workarounds.
Cisco Cisco BroadWorks · Updated 13 Nov · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 10 Nov; US agencies must fix by 24 Nov
SeverityhighCVSS 7.5 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the workaround recommended by Cisco in their security advisory, which may include disabling external entity resolution or restricting access to the OCI-P service.
- Monitor your Cisco BroadWorks systems for any unauthorized file reads or suspicious XML traffic.
- Check for any additional vendor guidance at Cisco's official security page for this vulnerability.
- If you have not yet applied any available patches (when they become available), prioritize this as a high-severity issue.
What happened
- 10 NovCISA adds CVE-2026-20320 to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to fix by 2026-11-24.
- 11 NovBleepingComputer reports CISA flags Cisco BroadWorks flaw as actively exploited.
- 11 NovThe Hacker News reports that Cisco BroadWorks and another flaw are actively exploited despite available patches.
- 12 NovCisco releases an advisory for an Out-of-Band Blind XML External Entity Injection vulnerability in BroadWorks.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-20320 | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | high 7.5 | 10 Nov | 0.8% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
Cisco · 12 NovCisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability ↗BleepingComputer · 11 NovCISA flags Cisco BroadWorks flaw as actively exploited in attacks ↗The Hacker News · 11 NovCisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches ↗CISA · 10 NovCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-20320 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free